Tentei da seguinte forma:
<managed-bean>
<managed-bean-name>Cer</managed-bean-name>
<managed-bean-class>crematorio.handlers.InsereHandler</managed-bean-class>
<managed-bean-scope>request</managed-bean-scope>
<managed-property>
<property-name>ufederal</property-name>
<property-class>javax.faces.component.html.HtmlSelectOneMenu</property-class>
<value/>
</managed-property>
</managed-bean>
e la onde tem o criterio assim:
ci.add(Restrictions.ilike("uf", ufederal.getValue().toString() ));
e obtive o mesmo erro 
Caused by:
java.lang.NullPointerException -
Error reading 'populaCidadeCond' on type crematorio.handlers.InsereHandler
Sempre e´bom aprender uma maneira melhor de fazer as coisas
, quando puder posta sobre o bean que vc comentou.
Brigado!
Seila , vai o Stack todo, vai que nao estou vendo algo ai no meio.
12:10:18,875 WARN WebXmlParser:347 - Ignored element 'dispatcher' as child of 'filter-mapping'.
12:10:18,875 WARN WebXmlParser:347 - Ignored element 'dispatcher' as child of 'filter-mapping'.
12:10:18,875 WARN WebXmlParser:347 - Ignored element 'dispatcher' as child of 'filter-mapping'.
12:10:20,578 WARN HtmlGridRendererBase:235 - PanelGrid j_id_jsp_779470609_7:painelgeral has not enough children. Child count should be a multiple of the columns attribute.
12:10:21,937 ERROR _ErrorPageWriter:350 - An exception occurred
javax.faces.FacesException: Exception while saving state of component : {Component-Path : [Class: org.ajax4jsf.component.AjaxViewRoot,ViewId: /opera/modelo.jsp][Class: org.apache.myfaces.custom.tabbedpane.HtmlPanelTabbedPane,Id: ptp00][Class: org.apache.myfaces.custom.tabbedpane.HtmlPanelTab,Id: j_id_jsp_779470609_6][Class: javax.faces.component.html.HtmlForm,Id: j_id_jsp_779470609_7][Class: javax.faces.component.html.HtmlPanelGrid,Id: painelgeral][Class: javax.faces.component.html.HtmlSelectOneMenu,Id: ufederal][Class: org.apache.myfaces.custom.savestate.UISaveState,Id: salva]}
at javax.faces.component.UIComponentBase.processSaveState(UIComponentBase.java:730)
at javax.faces.component.UIComponentBase.processSaveState(UIComponentBase.java:717)
at javax.faces.component.UIComponentBase.processSaveState(UIComponentBase.java:717)
at javax.faces.component.UIComponentBase.processSaveState(UIComponentBase.java:717)
at javax.faces.component.UIComponentBase.processSaveState(UIComponentBase.java:717)
at javax.faces.component.UIComponentBase.processSaveState(UIComponentBase.java:717)
at javax.faces.component.UIComponentBase.processSaveState(UIComponentBase.java:717)
at org.ajax4jsf.application.AjaxStateManager.getComponentStateToSave(AjaxStateManager.java:149)
at org.ajax4jsf.application.AjaxStateManager.buildSerializedView(AjaxStateManager.java:271)
at org.ajax4jsf.application.AjaxStateManager.saveSerializedView(AjaxStateManager.java:254)
at javax.faces.application.StateManager.saveView(StateManager.java:84)
at org.apache.myfaces.application.jsp.JspViewHandlerImpl.renderView(JspViewHandlerImpl.java:393)
at org.ajax4jsf.application.ViewHandlerWrapper.renderView(ViewHandlerWrapper.java:108)
at org.ajax4jsf.application.AjaxViewHandler.renderView(AjaxViewHandler.java:189)
at org.apache.myfaces.lifecycle.RenderResponseExecutor.execute(RenderResponseExecutor.java:41)
at org.apache.myfaces.lifecycle.LifecycleImpl.render(LifecycleImpl.java:140)
at javax.faces.webapp.FacesServlet.service(FacesServlet.java:152)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:290)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
at org.ajax4jsf.webapp.BaseXMLFilter.doXmlFilter(BaseXMLFilter.java:147)
at org.ajax4jsf.webapp.BaseFilter.doFilter(BaseFilter.java:276)
at org.ajax4jsf.Filter.doFilter(Filter.java:175)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
at org.apache.myfaces.webapp.filter.ExtensionsFilter.doFilter(ExtensionsFilter.java:144)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
at crematorio.filters.FilterLog.doFilter(FilterLog.java:33)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
at crematorio.factory.HibernateSessionFilterC.doFilter(HibernateSessionFilterC.java:32)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:233)
at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:175)
at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:128)
at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102)
at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109)
at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:286)
at org.apache.coyote.http11.Http11AprProcessor.process(Http11AprProcessor.java:856)
at org.apache.coyote.http11.Http11AprProtocol$Http11ConnectionHandler.process(Http11AprProtocol.java:565)
at org.apache.tomcat.util.net.AprEndpoint$Worker.run(AprEndpoint.java:1509)
at java.lang.Thread.run(Unknown Source)
Caused by: javax.el.ELException: javax.el.ELException: Error reading 'populaCidadeCond' on type crematorio.handlers.InsereHandler
at javax.faces.component._ValueBindingToValueExpression.invoke(_ValueBindingToValueExpression.java:267)
at javax.faces.component._ValueBindingToValueExpression.getValue(_ValueBindingToValueExpression.java:99)
at javax.faces.component.UIParameter.getValue(UIParameter.java:62)
at org.apache.myfaces.custom.savestate.UISaveState.saveState(UISaveState.java:65)
at javax.faces.component.UIComponentBase.processSaveState(UIComponentBase.java:728)
... 42 more
Caused by: javax.faces.el.EvaluationException: javax.el.ELException: Error reading 'populaCidadeCond' on type crematorio.handlers.InsereHandler
at org.apache.myfaces.el.convert.ValueExpressionToValueBinding.getValue(ValueExpressionToValueBinding.java:168)
at javax.faces.component._ValueBindingToValueExpression$2.invoke(_ValueBindingToValueExpression.java:103)
at javax.faces.component._ValueBindingToValueExpression.invoke(_ValueBindingToValueExpression.java:259)
... 46 more
Caused by: javax.el.ELException: Error reading 'populaCidadeCond' on type crematorio.handlers.InsereHandler
at javax.el.BeanELResolver.getValue(BeanELResolver.java:66)
at javax.el.CompositeELResolver.getValue(CompositeELResolver.java:53)
at org.apache.myfaces.el.unified.resolver.FacesCompositeELResolver.access$301(FacesCompositeELResolver.java:46)
at org.apache.myfaces.el.unified.resolver.FacesCompositeELResolver$4.invoke(FacesCompositeELResolver.java:108)
at org.apache.myfaces.el.unified.resolver.FacesCompositeELResolver.invoke(FacesCompositeELResolver.java:148)
at org.apache.myfaces.el.unified.resolver.FacesCompositeELResolver.getValue(FacesCompositeELResolver.java:104)
at org.apache.el.parser.AstValue.getValue(AstValue.java:114)
at org.apache.el.ValueExpressionImpl.getValue(ValueExpressionImpl.java:186)
at org.apache.myfaces.el.convert.ValueExpressionToValueBinding.getValue(ValueExpressionToValueBinding.java:160)
... 48 more
Caused by: java.lang.NullPointerException
at org.hibernate.criterion.IlikeExpression.getTypedValues(IlikeExpression.java:46)
at org.hibernate.loader.criteria.CriteriaQueryTranslator.getQueryParameters(CriteriaQueryTranslator.java:251)
at org.hibernate.loader.criteria.CriteriaLoader.list(CriteriaLoader.java:94)
at org.hibernate.impl.SessionImpl.list(SessionImpl.java:1569)
at org.hibernate.impl.CriteriaImpl.list(CriteriaImpl.java:283)
at crematorio.handlers.InsereHandler.getCidadeCond(InsereHandler.java:94)
at crematorio.handlers.InsereHandler.getPopulaCidadeCond(InsereHandler.java:82)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(Unknown Source)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source)
at java.lang.reflect.Method.invoke(Unknown Source)
at javax.el.BeanELResolver.getValue(BeanELResolver.java:62)
... 56 more
Grato.