The server crashes when a query is eligible for an OR pushdown through an $elemMatch object with an $or descendent. This issue only affects query shapes that involve an $elemMatch-$or construction, such as the following:

coll.find({a: 1, $or: [{b: 2}, {b: {$elemMatch: {$or: [{c: 4}, {c: 5}]}}}]});