If an oplog query with a read concern afterClusterTime is run on a node while it is in initial sync but doesn't have an oplog, then it will seg-fault. This is similar to SERVER-34249, though this time the node's config is initialized. I think this is probably possible on 3.6 as well, though the implementer should check.