If a BSONObjBuilder or BSONArrayBuilder is destroyed and done() or obj() have not been called, _done() is invoked by the destructor.
_done(), in turn, calls _BufBuilder::grow() to make space for EOO.
When an attempt is made by _BufBuilder::grow_reallocate() (called by grow()) to expand the buffer over BufferMaxSize a MsgAssertionException is raised by msgasserted(13548, "BufBuilder attempted to grow() " ... " past the 64MB limit").
This exception is not catchable and crashes the process.

A suboptimal workaround is to make sure to call *Builder::doneFast() before the builder's destructor is invoked when there's a chance that the constructed BSONObject exceeds 64MB.

A possible solution involves reserving space for EOO when creating a builder so that the destructor never needs to grow the buffer to append EOO.