Prior to SERVER-119491 (added in 9.0), we had this cloneUsingNewExpCtx logic which used to serialise and reparse an expression tree using a new ExpressionContext. This re-creates the expression and therefore could not have pointers dangling to the previous expression context.

After SERVER-119491, the clone method of all expressions was updated to accept a target ExpressionContext* for the cloned result.

In clone(), ExpressionSortArray, ExpressionTopN, ExpressionTop, ExpressionBotton and ExpressionBottomN simply copy the PatternValueCmp _sortBy member.

But PatternValueCmp stores a pointer to the Collator from the original ExpressionContext. When the original ExpressionContext is destroyed the pointer becomes dangling.

The targeted fix is clone PatternValueCmp by calling it's constructor with the new ExpCtx.