The GlobalLockServerStatusSection assumes that it can lock a Client's mutex and then call this function on that Client:
clientOpCtx->lockState()->getClientState()

However, we routinely swap out or change the lock state pointer in an OperationContext without locking the mutex. This can cause the server status section code to hit a null pointer, or read freed memory. The fix should be to ensure that the Client mutex is locked before touching an OperationContext's _locker member. Currently, there are two member functions that do this: setLockState() and swapLockState().