It looks like parsing an empty object in Expression::parseObject() produces a null pointer. And ExpressionNary::optimize() does not expect null pointers in vpOperand.

Test:

c = db.c;
c.drop();
c.save( {} );
c.aggregate( { $project:{ a:{ $and:[ {} ] } } } );