Currently, we assume that by reserving four bytes at the beginning of a buffer, we are permitted to re-interpret cast that region of memory to a BSONObj::Holder.

In fact, it is only legal to reinterpret_cast a region of memory to a class type if the memory originally held a properly constructed object of that type.

An additional problem is that the region of memory owned by the BSONObjBuilder may be realloc'ed. We cannot place a class at the beginning of the region and assume that it will survive realloc.

Instead, we should refactor the relationship between BSONObjBuilder and BSONObj so that the builder reserves but does not initialize a prefix region of appropriate size and alignment to hold a BSONObj::Holder, and then BSONObj placement new's a Holder into that region when it takes ownership of the buffer.