StackTrace::sink can be (and typically is) called with a nullptr sink. If the _error member is non-empty, this will be deferenced. We'll then (probably) crash while handling a crash. Note that the normal crash handling path goes through StackTrace::log, which calls sink with nullptr. 

The case where MONGO_STACKTRACE_BACKEND == MONGO_STACKTRACE_BACKEND_NONE is even worse (here). We'll always have an error and always crash.