As seen in BF-32209, it's possible to specify "config" as the shard name to the enableSharding command. The command will fail, but if the database did not yet exist an entry will still be inserted into config.databases with the config shard as the primary shard for the database. This can eventually lead to crashes (see this comment).

Similarly, "config" can be specified as the toShard in the moveRange command, which will also crash the config server.