This problem showed up during testing of another feature.  scoped_bson_t holds an internal flag to signal if it holds memory.  When steal() is called, the scoped_bson_t releases its owned memory to the caller; it should clear its ownership flag, too.