This was found on a 2.2 server but the defect still exists in master. The mongod was running a replica set heartbeat command against another node but received some corrupted BSON in the results. On closer inspection, it appears validateBSON is not called in this code path.

Here's a demangled stack trace:

... [rsHealthPoll] Assertion: 10320:BSONElement: bad type -51
0xaffd31 0xac5eb9 0x57105b 0x5a631d 0x592ac6 0x5a86e7 0x5a8b51 0x94f5c5 0x9555c2 0x955dd8 0xacd6ce 0xac8dfe 0xaca444 0xb45ba9 0x7f3ae7921e9a 0x7f3ae6c36dbd
/usr/bin/mongod(mongo::printStackTrace(std::basic_ostream<char, std::char_traits<char> >&)+0x21) [0xaffd31]
/usr/bin/mongod(mongo::msgasserted(int, char const*)+0x99) [0xac5eb9]
/usr/bin/mongod(mongo::BSONElement::size() const+0x1cb) [0x57105b]
/usr/bin/mongod(mongo::BSONObj::getField(mongo::StringData const&) const+0x7d) [0x5a631d]
/usr/bin/mongod(mongo::DBClientWithCommands::isOk(mongo::BSONObj const&)+0x26) [0x592ac6]
/usr/bin/mongod(mongo::DBClientWithCommands::runCommand(std::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, mongo::BSONObj const&, mongo::BSONObj&, int, mongo::AuthenticationTable const*)+0x2f7) [0x5a86e7]
/usr/bin/mongod(mongo::DBClientConnection::runCommand(std::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, mongo::BSONObj const&, mongo::BSONObj&, int, mongo::AuthenticationTable const*)+0x11) [0x5a8b51]
/usr/bin/mongod(mongo::requestHeartbeat(std::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::basic_string<char, std::char_traits<char>, std::allocator<char> >, mongo::BSONObj&, int, int&, bool)+0x565) [0x94f5c5]
/usr/bin/mongod(mongo::ReplSetHealthPollTask::_requestHeartbeat(mongo::HeartbeatInfo&, mongo::BSONObj&, int&)+0xf2) [0x9555c2]
/usr/bin/mongod(mongo::ReplSetHealthPollTask::doWork()+0xa8) [0x955dd8]
/usr/bin/mongod(mongo::task::Task::run()+0x1e) [0xacd6ce]
/usr/bin/mongod(mongo::BackgroundJob::jobBody(boost::shared_ptr<mongo::BackgroundJob::JobStatus>)+0xbe) [0xac8dfe]
/usr/bin/mongod(boost::detail::thread_data<boost::_bi::bind_t<void, boost::_mfi::mf1<void, mongo::BackgroundJob, boost::shared_ptr<mongo::BackgroundJob::JobStatus> >, boost::_bi::list2<boost::_bi::value<mongo::BackgroundJob*>, boost::_bi::value<boost::shared_ptr<mongo::BackgroundJob::JobStatus> > > > >::run()+0x74) [0xaca444]
/usr/bin/mongod() [0xb45ba9]
/lib/x86_64-linux-gnu/libpthread.so.0(+0x7e9a) [0x7f3ae7921e9a]
/lib/x86_64-linux-gnu/libc.so.6(clone+0x6d) [0x7f3ae6c36dbd]