There are several pieces of code throughout the explain path (e.g. here) that utilize a mapping of PlanStageKey to a raw pointer to a QSN. This is fragile since it makes the assumption that post-planner code (lowering) will not alter the QSN(s). Currently this is not true for a very narrow case (https://github.com/10gen/mongo/blob/e35ef639392ae48181c41f4c92807cd4fdae0dc6/src/mongo/db/query/planner_analysis.h#L123) however there's no guarantee that more examples won't get introduced.