When the CursorIdCache::timeoutCursors() iterates over its cursors, it locks them using an AutoGetCollectionForReadCommand title that will uassert when locking a view.

There should not be a view among the cursors managed by CursorIdCache, but timeoutCursors() does not hold the lock while it iterates, so there is a window of time during which a collection can be dropped and replaced by a view with the same name. Because the uassert occurs as part of the cursor cleanup background job, it crashes the server.