Under some conditions adding a dynamic section to a configuration screen fails with the abovementioned error. In renderOnDemand, c.innerHTML = "<TABLE><TBODY>"+t.responseText+"</TBODY></TABLE>"; succeeds yet immediately afterwards c.firstChild is a HTMLLinkElement rather than the expected HTMLTableElement:

<link rel="stylesheet" href="/adjuncts/…/lib/form/section_.css" type="text/css">

The second child is indeed the expected table, so something inserted this link element at the top.

Uri Scheiner says this occurred for him due to <f:advanced> under a separated <f:section>, yet it seems to occur under other circumstances as well.