dereference.of.nullable on a local variable after call in nested try-finally

Minimized from the real code:

$ cat Monitor.java
class Monitor {
  void acquire() {
    String s = "";

    try {
      return;
    } finally {
      try {
        signal();
      } finally {
        s.toString();
      }
    }
  }

  void signal() {}
}

$ checker/bin/javac -processor org.checkerframework.checker.nullness.NullnessChecker Monitor.java
Monitor.java:11: error: [dereference.of.nullable] dereference of possibly-null reference s
        s.toString();
        ^
1 error

I don't think there's a way for s to be null there.

Source file and -version -verbose -AprintAllQualifiers output attached.

Start by compiling the minimized Monitor.java example with checker/bin/javac and the NullnessChecker, then inspect how nested try-finally control flow is analyzed. Use the reported dereference.of.nullable diagnostic as the regression case; done means s.toString() is accepted when s is initialized to a non-null value.