It is possible to get into this situation if you first add the shard tag range manually to the config.tags collection. (The sh.addTagRange() helper will refuse to add the tag range if the tag does not currently map to any shards).
Of course this is an instance of "don't do that. use the helper." I'd thought I'd file this anyway if you wanted to work on preventing the crash from occurring.
Logs attached.