I've turned on some more debugging and now get the following:
16:15:24,135 DEBUG [org.alfresco.web.app.servlet.UploadFileServlet] Uploading servlet servicing…
16:15:24,167 DEBUG [org.alfresco.web.app.servlet.UploadFileServlet] Processing uploaded file: company-footer.xsd
16:15:24,171 DEBUG [org.alfresco.web.app.servlet.UploadFileServlet] Temp file: /tmp/Alfresco/alfresco10831.upload created from upload filename: company-footer.xsd
16:15:24,171 DEBUG [org.alfresco.web.app.servlet.UploadFileServlet] Sending back javascript response window.parent.upload_complete_helper('schema',{error: '${_UPLOAD_ERROR}', fileTypeImage: '${_FILE_TYPE_IMAGE}'})
16:15:24,298 DEBUG [org.alfresco.web.bean.wcm.CreateFormWizard] getSchemaRootElementNameChoices(null) = 0
16:15:24,299 DEBUG [org.alfresco.web.bean.wcm.CreateFormWizard] getSchemaRootElementNameChoices(null) = 0
16:15:24,300 DEBUG [org.alfresco.web.bean.wcm.CreateFormWizard] schemaFileValueChanged(company-footer.xsd[/tmp/Alfresco/alfresco10831.upload])
16:15:24,337 ERROR [org.alfresco.web.ui.common.Utils] unable to parse company-footer.xsd: null
java.lang.NullPointerException
        at org.alfresco.web.forms.xforms.SchemaUtil.parseSchema(SchemaUtil.java:219)
        at org.alfresco.web.bean.wcm.CreateFormWizard.schemaFileValueChanged(CreateFormWizard.java:612)
        at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
        at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
        at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
        at java.lang.reflect.Method.invoke(Method.java:585)
        at org.apache.myfaces.el.MethodBindingImpl.invoke(MethodBindingImpl.java:129)
        at javax.faces.component.UIInput.broadcast(UIInput.java:200)
        at javax.faces.component.UIViewRoot._broadcastForPhase(UIViewRoot.java:90)
        at javax.faces.component.UIViewRoot.processDecodes(UIViewRoot.java:132)
        at org.apache.myfaces.lifecycle.LifecycleImpl.applyRequestValues(LifecycleImpl.java:200)
        at org.apache.myfaces.lifecycle.LifecycleImpl.execute(LifecycleImpl.java:71)
        at javax.faces.webapp.FacesServlet.service(FacesServlet.java:105)
        at weblogic.servlet.internal.StubSecurityHelper$ServletServiceAction.run(StubSecurityHelper.java:223)
        at weblogic.servlet.internal.StubSecurityHelper.invokeServlet(StubSecurityHelper.java:125)
        at weblogic.servlet.internal.ServletStubImpl.execute(ServletStubImpl.java:283)
        at weblogic.servlet.internal.TailFilter.doFilter(TailFilter.java:26)
        at weblogic.servlet.internal.FilterChainImpl.doFilter(FilterChainImpl.java:42)
        at org.alfresco.web.app.servlet.AuthenticationFilter.doFilter(AuthenticationFilter.java:73)
        at weblogic.servlet.internal.FilterChainImpl.doFilter(FilterChainImpl.java:42)
        at weblogic.servlet.internal.WebAppServletContext$ServletInvocationAction.run(WebAppServletContext.java:3243)
        at weblogic.security.acl.internal.AuthenticatedSubject.doAs(AuthenticatedSubject.java:321)
        at weblogic.security.service.SecurityManager.runAs(SecurityManager.java:121)
        at weblogic.servlet.internal.WebAppServletContext.securedExecute(WebAppServletContext.java:2003)
        at weblogic.servlet.internal.WebAppServletContext.execute(WebAppServletContext.java:1909)
        at weblogic.servlet.internal.ServletRequestImpl.run(ServletRequestImpl.java:1359)
        at weblogic.work.ExecuteThread.execute(ExecuteThread.java:209)
        at weblogic.work.ExecuteThread.run(ExecuteThread.java:181)
16:15:24,339 DEBUG [org.alfresco.web.bean.wcm.CreateFormWizard] getSchemaRootElementNameChoices(null) = 0
16:15:24,339 DEBUG [org.alfresco.web.bean.wcm.CreateFormWizard] getSchemaRootElementNameChoices(null) = 0
16:15:24,340 DEBUG [org.alfresco.web.bean.wcm.CreateFormWizard] getSchemaRootElementNameChoices(null) = 0
16:15:24,340 DEBUG [org.alfresco.web.bean.wcm.CreateFormWizard] getSchemaRootElementNameChoices(null) = 0
16:15:24,369 DEBUG [org.alfresco.web.bean.wcm.CreateFormWizard] getSchemaRootElementNameChoices(null) = 0
16:15:24,370 DEBUG [org.alfresco.web.bean.wcm.CreateFormWizard] getSchemaRootElementNameChoices(null) = 0
16:15:24,370 DEBUG [org.alfresco.web.bean.wcm.CreateFormWizard] getSchemaRootElementNameChoices(null) = 0
16:15:24,370 DEBUG [org.alfresco.web.bean.wcm.CreateFormWizard] getSchemaRootElementNameChoices(null) = 0
16:15:24,370 DEBUG [org.alfresco.web.bean.wcm.CreateFormWizard] getSchemaRootElementNameChoices(null) = 0
I think the exception is thrown from this method in org.alfresco.web.bean.wcm.CreateFormWizard:
 
   public String schemaFileValueChanged(final ValueChangeEvent vce)
   {
      if (LOGGER.isDebugEnabled())
      {
         LOGGER.debug("schemaFileValueChanged(" + this.getFileName(FILE_SCHEMA) + 
                      "[" + this.getSchemaFile() + "])");
      }
      if (this.getSchemaFile() != null)
      {
         try
         {
            final Document d = XMLUtil.parse(this.getSchemaFile());
            this.schema = SchemaUtil.parseSchema(d);
         }
         catch (Exception e)
         {
            final String msg = "unable to parse " + this.getFileName(FILE_SCHEMA);
            this.removeUploadedSchemaFile();
            Utils.addErrorMessage(msg + ": " + e.getMessage(), e);
         }
      }
      return null;
   }