Bernard made a very insightful comment in a code review which lead us to realize this behavior:

db.c.drop();
db.c.insert({b: 1});

const query = {a: {$gte: null}};
// Returns the document. {b:1}
printjson(db.c.find(query).toArray());

db.c.createIndex({a: 1}, {sparse: true});

// Returns nothing.
printjson(db.c.find(query).toArray());

On a query like {a: {$gte: null}}, the planner may choose to use a sparse index on 'a', even though the results should include documents which don't have an 'a' field (and therefore, don't have a key in the sparse index).

I plan on fixing this as part of SERVER-36731, but we should probably do a special fix for older branches. [EDIT: We should decide which behavior is correct before changing anything].