The code in ElemMatchObjectMatchExpression::matchesArray() is not checking for strict object type for sub-objects. This means the _sub match expression could incorrectly be applied on a sub-array and match wrong documents in some cases. We should change the above condition to inner.type() == Object instead.