There is a mistyped invariant here:

https://github.com/mongodb/mongo/blob/r3.5.4/src/mongo/db/query/planner_access.cpp#L1218

It currently reads

invariant(MatchExpression::ELEM_MATCH_OBJECT);

However, this will always pass, since the ELEM_MATCH_OBJECT enum value is non-zero. Instead, this check is supposed to verify that the MatchExpression node is of type ELEM_MATCH_OBJECT.