If a new migration recipient primary steps-up and then fails (e.g. stepsdown too) during migration recovery, indeed _migrateThread will throw. On cleanup, it will dereference _sessionMigration, which if that node instance had never been the recipient of a migration, will be nullptr.
It is fine that _sessionMigration is nullptr on recovery. We should just not blindly dereference it in the error handling path.