moveCollection is allowed to run after removeShard has passed the "draining phase". This can then result in user data being on a replica set that is no longer a shard. 

More specifically consider the following sequence of events:

1. removeShard is run on the config shard, and all the collections and databases are drained from the config shard
2. removeShard then proceeds to remove the config.shards entry for the config shard and complete
3. But before that happens, a moveCollection can run that moves a collection X back onto the config shard.
4. Then when removeShard completes, collection X remains on the config server despite it not being a shard.

Script to reproduce the issue: https://gist.github.com/wenqinYe/5941fc4587211db51bbf5c808813b801