MatchExpressionParser::_parse() is intended to iterate through each top-level element of the match expression, parse that element, and add the result to an AndMatchExpression. In several cases, however, we instead return the result without adding it to the AndMatchExpression. One such case handles the $jsonSchema expression:

https://github.com/mongodb/mongo/blob/master/src/mongo/db/matcher/expression_parser.cpp#L586-L600

As a result, the MatchExpression is parsed incorrectly and will return extra results. In this example, the document with a equal to 1 is returned incorrectly:

> db.c.drop()
true
> db.c.insert({a: 1})
WriteResult({ "nInserted" : 1 })
> db.c.insert({a: 2})
WriteResult({ "nInserted" : 1 })
> db.c.find({$jsonSchema: {}, a: 2})
{ "_id" : ObjectId("59b6fbbfd29495ce436648f2"), "a" : 1 }
{ "_id" : ObjectId("59b6fbc0d29495ce436648f3"), "a" : 2 }

This was introduced during development of the JSON Schema project, and therefore does not affect any stable version of the server.