The implementation of find command on mongod checks the shard version outside of collection lock. This means that the collection might change after it has been checked, but before the command actually starts returning results and thus it may return results, which do not belong to the shard being queried.

This should be easy to fix by moving the collection lock up.