The replica set change notifier makes a copy of _listeners under a lock, but then invokes onConfirmedSet on those listeners outside the lock. During shutdown, those pointers can be dead, which can cause us to use after free and crash.

See replica_set_change_notifier.cpp#L116-L120

    auto listeners = _listeners;
    lk.unlock();

    for (auto listener : listeners) {
        listener->onConfirmedSet(state);
    };