It looks like if multiple indexes are requested via a single createIndexes cmd, we can incorrectly build indexes that exceed the allowable number for various reasons. For example, IndexCatalogImpl::_doesSpecConflictWithExisting will check that we are not exceeding the _maxNumIndexesAllowed setting. However, suppose the max is 5, the collection has 4 indexes and a createIndexes cmd requests 2 more indexes. Then we will run IndexCatalogImpl::_doesSpecConflictWithExisting on both index specs, it'll pass, and we will go build 2 more indexes – this is because neither index is part of the index catalog yet.
It looks like we could bypass the subsequent text index limit check, too, if a caller specified two text indexes in one createIndexes cmd.