Well I dug in and found the problem...
It seems that if you use the AspNetSecurity.Membership the function CreateMembershipUser function in AspNetMembershipProvider.vb does not take into consideration the option for requiring a security question and answer.
I.e. in the web config if you specify:
<add name="AspNetSqlMembershipProvider" type="System.Web.Security.SqlMembershipProvider" connectionStringName="SiteSqlServer" enablePasswordRetrieval="true" enablePasswordReset="true" requiresQuestionAndAnswer="true" minRequiredPasswordLength="7" minRequiredNonalphanumericCharacters="0" requiresUniqueEmail="true" passwordFormat="Encrypted" applicationName="DotNetNuke" description="Stores and retrieves membership data from the local Microsoft SQL Server database"/>
The creation of the user fails with an AspNetSecurity.MembershipCreateStatus.InvalidAnser as the call to create the user:
objMembershipUser = AspNetSecurity.Membership.CreateUser(userName, user.Membership.Password, email,
Nothing, Nothing, True, objStatus)
Simply passes in Nothing for the security question and security answer causing the user creation to fail and thus bubble up as a null ref exception.
So the moral of the story is do not require a security Question and Answser in the web.config file for the AspNetSqlMembershipProvider option requiresQuestionAndAnswer="true".
The UserInfo class should be updated to hold the Security Question and Answer, populate the info if specified in the DotNetNuke.Install.config specification for the host and admin users, and then the CreateMembershipUser() should pass the information if populated when calling AspNetSecurity.Membership.CreateUser() instead of Nothing, Nothing.
FYI: Seems that the lookup for the Localization of the "InvalidAnswer" message is what is throwing the NullRef in UserController.GetUserCreateStatus() in namespace DotNetNuke.Entities.Users.
Enjoy
Chris Buzzetta