View image intent results in HostPhotoViewIntentPhotoOneUpActivity crash

When an attachment has been downloaded an intent to view the attachment is created and an activity is launched that is registered to handle the MIME-type specified in the response headers content-type field. The code that does this looks like this:

private class ViewRemoteFileTask extends AsyncTask<String, Void, File> {

    private Exception exception;
    private Context context;
    private String contentType;

    @Override
    protected File doInBackground(String... urls) {
        this.context = InAppBrowser.this.cordova.getActivity();
        File dir = new File(this.context.getCacheDir(), CONTENT_DIR);
        dir.mkdirs();
        File outFile = new File(dir, "tempfile");
        try {
            URL pdfUrl = new URL(urls[0]);
            HttpsURLConnection urlConnection = (HttpsURLConnection) pdfUrl.openConnection();
            InAppBrowser.this.onDownloadStart();
            contentType = urlConnection.getContentType();
            InputStream is = new BufferedInputStream(urlConnection.getInputStream());
            FileOutputStream fos = new FileOutputStream(outFile);
            byte[] buffer = new byte[1024];
            int len = 0;
            while ( (len = is.read(buffer)) > 0) {
                fos.write(buffer, 0, len);
            }
            fos.close();
            return outFile;
        }
        // @TODO Add proper error handling
        catch (Exception e) {
            this.exception = e;
            return null;
        }
    }

    @Override
    protected void onPostExecute(File file) {
        Intent intent = new Intent(Intent.ACTION_VIEW);
        Uri contentUri = FileProvider.getUriForFile(this.context, KIVRA_PROVIDER, file);
        intent.setDataAndType(contentUri, contentType);
        intent.setFlags(Intent.FLAG_GRANT_READ_URI_PERMISSION);
        InAppBrowser.this.onDownloadFinished();
        // check if there are an application available to present this filetype
        if (intent.resolveActivity(context.getPackageManager()) != null) {
            context.startActivity(intent);
        }
        // display error message
        else {
            CharSequence text = "Could not find application for this filetype";
            int duration = Toast.LENGTH_LONG;
            Toast toast = Toast.makeText(context, text, duration);
            toast.show();
        }
    }
}

When trying to open jpeg attachments on some Android versions, this results in the image viewing app opening up but then directly crashes while telling the user that "Google+ has unfortunately been stopped". This has only been an issue for Android 5.x devices (where http://ift.tt/1dS5EzD handles the intent). It works fine on my Android 4.3 (where com.android.gallery3d/.app.Gallery handles the intent). The log of the crash on Android 5.1 looks like this:

I/ActivityManager(  554): START u0 {act=android.intent.action.VIEW dat=content://com.orgname.AppName.fileprovider/content/tempfile typ=image/jpeg flg=0x1 cmp=http://ift.tt/1dS5EzD (has extras)} from uid 10070 on display 0
V/WindowManager(  554): addAppToken: AppWindowToken{2d80c85b token=Token{bf53b6a ActivityRecord{d5c6555 u0 http://ift.tt/1dS5EzD t833}}} to stack=1 task=833 at 2
I/art     (23521): Explicit concurrent mark sweep GC freed 37234(2MB) AllocSpace objects, 10(154KB) LOS objects, 35% free, 29MB/45MB, paused 793us total 59.789ms
D/OpenGLRenderer(23521): Use EGL_SWAP_BEHAVIOR_PRESERVED: true
D/Atlas   (23521): Validating map...
V/WindowManager(  554): Adding window Window{1796b427 u0 http://ift.tt/1dS5EPT} at 4 of 10 (after Window{1b096494 u0 com.orgName.AppName/com.orgName.AppName.MainActivity})
I/OpenGLRenderer(23521): Initialized EGL, version 1.4
D/OpenGLRenderer(23521): Enabling debug mode 0
W/ActivityManager(  554): Permission Denial: Accessing service ComponentInfo{com.google.android.music/com.google.android.music.dial.DialMediaRouteProviderService} from pid=23521, uid=10070 that is not exported from uid 10064
I/System.out( 5066): YouTube MDX: MDX video stage moved to NEW
I/System.out( 5066): YouTube MDX: MDX video player state moved to UNSTARTED
I/System.out( 5066): YouTube MDX: MDX ad player state moved to UNSTARTED
I/CastSocket(16025): 22 >= 18. Adding new CastClientAuthKeyManager.
I/ActivityManager(  554): Displayed http://ift.tt/1dS5EzD: +652ms (total +670ms)
W/IInputConnectionWrapper(16432): showStatusIcon on inactive InputConnection
I/art     (  554): Explicit concurrent mark sweep GC freed 50214(2MB) AllocSpace objects, 5(77KB) LOS objects, 33% free, 24MB/36MB, paused 2.441ms total 127.666ms
D/WifiService(  554): New client listening to asynchronous messages
E/CursorWindow(23521): Failed to read row 0, column 0 from a CursorWindow which has 1 rows, 0 columns.
E/EsApplication(23521): Uncaught exception in background thread Thread[ImageLoader,5,main]
E/EsApplication(23521): java.lang.IllegalStateException: Couldn't read row 0, col 0 from CursorWindow.  Make sure the Cursor is initialized correctly before accessing data from it.
E/EsApplication(23521):     at android.database.CursorWindow.nativeGetString(Native Method)
E/EsApplication(23521):     at android.database.CursorWindow.getString(CursorWindow.java:438)
E/EsApplication(23521):     at android.database.AbstractWindowedCursor.getString(AbstractWindowedCursor.java:51)
E/EsApplication(23521):     at android.database.CursorWrapper.getString(CursorWrapper.java:114)
E/EsApplication(23521):     at mtr.a(PG:103)
E/EsApplication(23521):     at jsy.z(PG:1311)
E/EsApplication(23521):     at jsy.c(PG:1288)
E/EsApplication(23521):     at lbo.handleMessage(PG:293)
E/EsApplication(23521):     at android.os.Handler.dispatchMessage(Handler.java:98)
E/EsApplication(23521):     at android.os.Looper.loop(Looper.java:135)
E/EsApplication(23521):     at android.os.HandlerThread.run(HandlerThread.java:61)
E/EsApplication(23521):     at lbo.run(PG:280)
E/AndroidRuntime(23521): FATAL EXCEPTION: ImageLoader
E/AndroidRuntime(23521): Process: com.google.android.apps.plus, PID: 23521
E/AndroidRuntime(23521): java.lang.IllegalStateException: Couldn't read row 0, col 0 from CursorWindow.  Make sure the Cursor is initialized correctly before accessing data from it.
E/AndroidRuntime(23521):    at android.database.CursorWindow.nativeGetString(Native Method)
E/AndroidRuntime(23521):    at android.database.CursorWindow.getString(CursorWindow.java:438)
E/AndroidRuntime(23521):    at android.database.AbstractWindowedCursor.getString(AbstractWindowedCursor.java:51)
E/AndroidRuntime(23521):    at android.database.CursorWrapper.getString(CursorWrapper.java:114)
E/AndroidRuntime(23521):    at mtr.a(PG:103)
E/AndroidRuntime(23521):    at jsy.z(PG:1311)
E/AndroidRuntime(23521):    at jsy.c(PG:1288)
E/AndroidRuntime(23521):    at lbo.handleMessage(PG:293)
E/AndroidRuntime(23521):    at android.os.Handler.dispatchMessage(Handler.java:98)
E/AndroidRuntime(23521):    at android.os.Looper.loop(Looper.java:135)
E/AndroidRuntime(23521):    at android.os.HandlerThread.run(HandlerThread.java:61)
E/AndroidRuntime(23521):    at lbo.run(PG:280)
W/ActivityManager(  554):   Force finishing activity 1 http://ift.tt/1dS5EzD
W/ActivityManager(  554):   Force finishing activity 2 com.orgName.AppName/.MainActivity