Yup, huge bummer. One of the most user-visible changes in 1.6 is the addition of horses and the ability to ride them, but if you try to share the experience, the rider gets booted immediately from the server with the NPE.
Note this also happens if a user shares their single-player world over a LAN.
As Sean said, one workaround is to NBT to edit the player, and stop trying to ride horses for now 😞
dupe of MC-13628