It's currently possible to insert a document with '.' in the keys using update with upsert=True. We may be able to disallow this using the same checks that the mongo shell uses to differentiate between a document replacement (passing a document with no $ operators as the second param) and a modification (passing a document with a $ operator at the top level as the second param).

See db.foo.update (note no parens) in the shell for details.