ArrayDiffBuilder::addUpdate() does not take ownership of the data passed as BSONElement, which means that the temporary objects here gets freed after executing the line. When ArrayDiffBuilder tries to serialize, it expects the object to be still valid. We should also change all the other functions which pass a BSONElement, and not depend on the implementation of the DiffBuilders.