If you pass in an object with .constructor set to null as argument to tojson(), the tojson call fails:
v1.3.3 with spidermonkey:
> var a = new Object()
> a.constructor = null
null
> tojson(a)
Fri May 14 14:46:28 JS Error: TypeError: x.constructor has no properties (anon):393

error emssage on 1.4.2 with v8:
> tojson(a)
Fri May 14 14:51:14 exec error: shell setup:397 TypeError: Cannot read property 'tojson' of null
if ( typeof( x.constructor.tojson ) == "function" && x.constructor.tojson != t
^
I'm not sure whether have a null value for constructor has sane uses, but there are at least some situations where mongoDB produces it (as 'this' of the map funciton in the mapreduce when using v8, but I"ll open another bug for that). If it doesn't make sense to have a null value there, then please close this bug.