In WT-2802 Michael added a new assertion to session_api.c:wt_session_copy_values that has triggered. Here's one of them http://build.wiredtiger.com:8080/job/wiredtiger-test-format-stress-sanitizer/10573/console. This was sanitizer so there is no stack to know what path got us in there without a snapshot.