createForm method was trying to access getSecurityHandler() from itself, when it should have been using the data object since that object actually has the method, whereas AdminObjectAclManipulator doesn't.

Util/AdminObjectAclManipulator.php

@@ -64,7 +64,7 @@ class AdminObjectAclManipulator
         $objectIdentity = ObjectIdentity::fromDomainObject($data->getObject());
         $acl = $data->getSecurityHandler()->getObjectAcl($objectIdentity);
         if (!$acl) {
-            $acl = $this->getSecurityHandler()->createAcl($objectIdentity);
+            $acl = $data->getSecurityHandler()->createAcl($objectIdentity);
         }
 
         $data->setAcl($acl);