I experimented with a new fuzzer idea, and found SERVER-105667 and SERVER-105665.

It's difficult to model every aggregation stage perfectly. Instead we can run the core and aggregation suites with a high log level, and extract from the logs each aggregation stage that is run. We can then make one flat list of aggregation stages run in these suites.

Then we sample randomly from the list to create new aggregation pipelines, and run lots of them. The only assertion we make is that they don't crash the server or cause a tassert.

I'm not sure how it would be implemented, but I spent an hour or so trying it out and found two issues, so it may be worth investigating further.