Renames in the same database no longer swap Collection pointers in the UUIDCatalog. As soon as the rename sets a new NamespaceString on the collection, the entry in the UUID catalog changes, without having to take the UUIDCatlalog mutex. So even though the catalog is protected by a mutex, the _ns field on the Collection is not.

This means a lookup by UUID concurrent with a rename with a can potentially read the memory of a previous NamespaceString that has freed its underlying string.

The _ns field should be protected by a mutex for thread-safe read operations.