This fassert is caused by using $where (note the Scope::loadStored call in the stack). It looks like the calls to commitIfNeeded in the DBDirectClient class should be conditional on the type of lock held to avoid this assert.
Fatal Assertion 16110 0xade6e1 0x802e03 0xa07e7b 0xa0a226 0xa0a83a 0xa081b6 0xa0835c 0xb5eb60 0x6f698d 0xa90c3a 0xb506b6 0x786972 0xbce39c 0x929481 0x928abc 0xa0e287 0xa0ed48 0x84e39d 0x84e6e9 0x6ac10e /usr/bin/mongod(_ZN5mongo15printStackTraceERSo+0x21) [0xade6e1] /usr/bin/mongod(_ZN5mongo13fassertFailedEi+0xa3) [0x802e03] /usr/bin/mongod(_ZN5mongo3dur25assertLockedForCommittingEv+0x1b) [0xa07e7b] /usr/bin/mongod() [0xa0a226] /usr/bin/mongod(_ZN5mongo3dur11DurableImpl9commitNowEv+0x1a) [0xa0a83a] /usr/bin/mongod(_ZN5mongo3dur11DurableImpl16_aCommitIsNeededEv+0x66) [0xa081b6] /usr/bin/mongod(_ZN5mongo3dur11DurableImpl14commitIfNeededEb+0x4c) [0xa0835c] /usr/bin/mongod(_ZN5mongo14DBDirectClient4callERNS_7MessageES2_bPSs+0x290) [0xb5eb60] /usr/bin/mongod(_ZN5mongo14DBClientCursor4initEv+0xbd) [0x6f698d] /usr/bin/mongod(_ZN5mongo12DBClientBase5queryERKSsNS_5QueryEiiPKNS_7BSONObjEii+0xea) [0xa90c3a] /usr/bin/mongod(_ZN5mongo14DBDirectClient5queryERKSsNS_5QueryEiiPKNS_7BSONObjEii+0x56) [0xb506b6] /usr/bin/mongod(_ZN5mongo5Scope10loadStoredEb+0xf2) [0x786972] /usr/bin/mongod(_ZN5mongo7SMScope12localConnectEPKc+0x1ec) [0xbce39c] /usr/bin/mongod(_ZN5mongo5Where4initEv+0x121) [0x929481] /usr/bin/mongod(_ZNK5mongo7Matcher7matchesERKNS_7BSONObjEPNS_12MatchDetailsE+0x118c) [0x928abc] /usr/bin/mongod(_ZNK5mongo19CoveredIndexMatcher7matchesERKNS_7BSONObjERKNS_7DiskLocEPNS_12MatchDetailsEb+0xc7) [0xa0e287] /usr/bin/mongod(_ZNK5mongo19CoveredIndexMatcher14matchesCurrentEPNS_6CursorEPNS_12MatchDetailsE+0xa8) [0xa0ed48] /usr/bin/mongod(_ZN5mongo22QueryOptimizerCursorOp14currentMatchesEPNS_12MatchDetailsE+0xad) [0x84e39d] /usr/bin/mongod(_ZN5mongo24QueryOptimizerCursorImpl14currentMatchesEPNS_12MatchDetailsE+0x79) [0x84e6e9] /usr/bin/mongod(_ZN5mongo20QueryResponseBuilder14currentMatchesERNS_12MatchDetailsE+0x1e) [0x6ac10e] Wed Sep 5 09:49:26 [conn57] ***aborting after fassert() failure