If the primary is the last element in the _nodes array a node is removed from the replica set, it is possible to call _checkConnection on the primary such that a node is removed from the _nodes array but then _master is set to the master's old index in the _nodes array, which now points to freed memory.