good discussion here: https://stackoverflow.com/questions/15138593/nvarchar-concatenation-index-nvarcharmax-inexplicable-behavior

relevant section to this application:

Even without ORDER BY, we do not guarantee that @var = @var + will produce the concatenated value for any statement...

I seem to recall that this sort of thing is sometimes discouraged:

SELECT  @catlist = @catlist + COALESCE(p.ProductCategory1, p.ProductCategory2, 'NA')  + ', '
 FROM dbo.Product AS...

You could be correct, but I am frustrated by the obscure nature of the failure (the null reference), the lack of documentation around the issue and the fact that VS...

instead of:
 conn.ConnectionString = "Data Source=.\\sqlexpress;Initial Catalog=tempdb;Integrated Security=True";

this is an option:
 conn.ConnectionString = @"Data Source=.\sqlexpress;Initial Catalog=tempdb;Integrated Security=True";

or even:
conn.ConnectionString =...