We are currently upgrading a site from CMS 6 to CMS 6 R2. The site has a couple of Dynamic Content's that uses BinaryFormatter to serialize/deserialize entire objects containing property type definitions and values for it's State.

Below is a simplified example of how the different Dynamic Contents are structured;

1) The Dynamic Content definition;

public class PageListDynamicContent : IDynamicContent
{
    public PageListDynamicContentData PageListDynamicContentData { get; set; }

    // More methods here, deleted for simplicity

    public string State
    {
        get
        {
            if (PageListDynamicContentData == null)
                return null;

            using (var stream = new MemoryStream())
            {
                new BinaryFormatter().Serialize(stream, PageListDynamicContentData);
                return Convert.ToBase64String(stream.ToArray());
            }
        }
        set
        {
            if (value == null)
                return;

            using (var stream = new MemoryStream(Convert.FromBase64String(value)))
            {
                stream.Position = 0;
                PageListDynamicContentData = new BinaryFormatter().Deserialize(stream) as PageListDynamicContentData;
            }
        }
    }
}

2) The PageListDynamicContentData-class;

[Serializable]
public class PageListDynamicContentData
{
    public PropertyPageReference ParentPage { get; set; }
    public PropertyLinkCollection ManualPages { get; set; }
    public PropertyNumber MaxPageCount { get; set; }
    public PropertyNumber TeaserTextLength { get; set; }
}

When trying to deserialize (in PageListDynamicContent.set_State(String value)) a "NullReferenceException" is thrown with the following stack trace;

at EPiServer.SpecializedProperties.PropertyXhtmlString.System.Runtime.Serialization.IDeserializationCallback.OnDeserialization(Object sender)
at System.Runtime.Serialization.DeserializationEventHandler.Invoke(Object sender)
at System.Runtime.Serialization.ObjectManager.RaiseDeserializationEvent()
at System.Runtime.Serialization.Formatters.Binary.ObjectReader.Deserialize(HeaderHandler handler, __BinaryParser serParser, Boolean fCheck, Boolean isCrossAppDomain, IMethodCallMessage methodCallMessage)
at System.Runtime.Serialization.Formatters.Binary.BinaryFormatter.Deserialize(Stream serializationStream, HeaderHandler handler, Boolean fCheck, Boolean isCrossAppDomain, IMethodCallMessage methodCallMessage)
at System.Runtime.Serialization.Formatters.Binary.BinaryFormatter.Deserialize(Stream serializationStream)
...on to application stack trace...

The property throwing this seems to be the PropertyLinkCollection (which inherits PropertyXhtmlString). The only change I can find that possible could be the cause is the change in how the constructors in PropertyLinkCollection has changed to now be able to take a IPermanentLinkMapper. On the other hand the empty constructor sets _linkMapper to a new PermanentLinkMapper.

I'm at a loss here and would appreciate any help.