I installed the Web Installer packages on 3 different XPSP3 Virtual Machine instances. I ran ALL 3 installations, Auto, Typical and Custom, on each Virtual Machine and encountered only 1 problem.
The very first installation attempt I got a "download package is corrupted" error message. I stopped the installation, cleaned out the .zip file and the DotNetNuke folder, restared the Web Installer and the installation completed without issue.
This is only the 2nd time using the Web installer I noticed the application automatically sets up the folder permissions so that should never be an issue.
When you run this for SQL Express I'm assuming you are setting up 1 SQL account with password, and using that in the Web Installer UI? Not just "sa" but dnntest with a password = dnntest ?
Anyway, as I mentioned above. I just installed Auto, Typical and Custom on 3 different XPSP3 VM's never ran into any "Null Reference" exceptions, thread aborts or any other errors showing up in the UI during installation. I was able to log into every instance and add a couple of pages/modules/users....
In all my installs the PortalAlias, Portals and PortalSettings tables are all populated.
Are there specific modules you are selecting during "Custom" installation? It's not recommended to choose ALL modules during Custom install as there is a great likelyhood of creating a database timeout condition.
when you re-run the Web Installer are you using a dffiferent database name for every attempt? You should be renaming the default "DotNetNuke" to something like "DotNetNuke2" or else deleting the "DotNetNuke" database before re-installing.