MultipleCollectionAccessor::lookupCollection can return a null pointer when the collection is not found.  When this gets passed into an SBE generateCollScan call, this null pointer gets passed down to generateGenericCollScan and dereferenced (or generateClusteredCollScan and dereferenced), causing a null pointer exception.  This can happen with other 
getCurrentCollection calls as well; here is an example with generateIndexScan.