For repro:

https://jira.mongodb.org/browse/BF-25571?focusedCommentId=4646592&page=com.atlassian.jira.plugin.system.issuetabpanels%3Acomment-tabpanel#comment-4646592

RCA:

https://jira.mongodb.org/browse/BF-25571?focusedCommentId=4648972&page=com.atlassian.jira.plugin.system.issuetabpanels%3Acomment-tabpanel#comment-4648972

Yoonsoo' debug log:
The SBE $type doing wrong was my first theory but it didn’t turn out to be. Here’s how I concluded the issue is related to the SBE plan cache.
The plan that is generated when the feature is off has the following subtree which is for {$type: 'object'} match.

            [2] project [s25 = fillEmpty (typeMatch (s24, 8), false)]
            [2] limit 1
            [2] coscan

I made a breakpoint there and it got called and I found it passed. So, I don’t think the SBE typeMatch is doing something wrong.
The plan which is generated when the feature is on also has the above subtree.
It didn’t get called at all. So, I made another breakpoint at the following traverse.

        [2] traverse s45 s44 s43 [s42, s41] {s45 || s44} {s45}
        from
            [2] project [s43 = getField (s41, "a")]
            [2] nlj [] [s40, s6, s9, s12, s15]
                left
                    [1] unique [s40]
                    [1] branch {s39} [s6, s9, s12, s15, s40] // This branch is unnecessarily added

The above traverse is on top of branch. And I confirmed that traverse didn’t return anything (at the first getNext() call, it returned EOF) and so typeMatch didn’t get a chance to be evaluated.
The only difference between two plans was branch. So I suspected that branch part caused the issue