If we create a fuzzer that generates a random query shape, then runs that query shape with different constants a few times, we can test auto-parameterization and and the plan cache code path. This would be more targeted than the existing fuzzers which are less likely to hit the plan cache since each query shape is completely different. This idea is meant to target the SBE plan cache, but could also target the classic plan cache.

coll.aggregate({$match: {a: 1}})
coll.aggregate({$match: {a: 2}})
// The query plan is now cached and the cache entry is active. Following queries will test the cache code path.
coll.aggregate({$match: {a: 3}})
coll.aggregate({$match: {a: "abc"}})

The results can be compared against a classic engine collection scan, or another mongod with the same data and engine configuration, except the plan cache is disabled. The latter might be easier because it would avoid false positives on known differences in results for covered queries.

What grammar this fuzzer would use is unclear. It could reuse an existing grammar or we could adjust weights to target stages that are more often parameterized