element_.eoo assertion on invalid upsert

<?php

class Site {

  public $url;

  public $title;

}

$site = new Site();

$db = new MongoDB(new Mongo(), 'wotato');

// Inserts { "_id" : ObjectId(...), "title" : null, "url" : null }

$db->test->update(array('url' => 'http://example.com'), array('$set' => $site), array('upsert' => true));

$site->url = 'http://example.com';

// As update: Assertion error in database engine

// Expected: Successful update { "_id" : ObjectId(...), "url" : "http://example.com", "title" : null }

$db->test->update(array('url' => 'http://example.com'), array('$set' => $site), array('upsert' => true));

$db->dropCollection('test');

// As insert: Assertion error here too

// Expected: Successful insert { "_id" : ObjectId(...), "url" : "http://example.com", "title" : null }

$db->test->update(array('url' => 'http://example.com'), array('$set' => $site), array('upsert' => true));

Wed Feb 10 03:10:10  test.test Assertion failure !element_.eoo() db/jsobjmanipulator.h 32

0x4e8316 0x4f095f 0x550e9a 0x557b36 0x5597a3 0x5cbd7c 0x5ce1ca 0x647105 0x65f930 0x7f6fbc721a04 0x7f6fbbce080d

 ./mongod(_ZN5mongo12sayDbContextEPKc+0xe6) [0x4e8316]

 ./mongod(_ZN5mongo8assertedEPKcS1_j+0x13f) [0x4f095f]

 ./mongod(_ZNK5mongo6ModSet16applyModsInPlaceERKNS_7BSONObjE+0x34a) [0x550e9a]

 ./mongod(_ZN5mongo6ModSet18createNewFromQueryERKNS_7BSONObjE+0x676) [0x557b36]

 ./mongod(_ZN5mongo13updateObjectsEPKcNS_7BSONObjES2_bbbRNS_7OpDebugE+0x1893) [0x5597a3]

 ./mongod(_ZN5mongo14receivedUpdateERNS_7MessageERNS_5CurOpE+0x60c) [0x5cbd7c]

 ./mongod(_ZN5mongo16assembleResponseERNS_7MessageERNS_10DbResponseERK11sockaddr_in+0xfaa) [0x5ce1ca]

 ./mongod(_ZN5mongo10connThreadEv+0x235) [0x647105]

 ./mongod(thread_proxy+0x80) [0x65f930]

 /lib/libpthread.so.0 [0x7f6fbc721a04]

 /lib/libc.so.6(clone+0x6d) [0x7f6fbbce080d]

Wed Feb 10 03:10:10 update test.test  query: { url: "http://example.com" } exception assertion db/jsobjmanipulator.h:32 1ms