When a document is 'cloned' in JavaScript, or if a field named '_bson' is created on a JS object passed to an internal mongo function, unwrapHolder() may return a NULL pointer. This is unchecked at most call-sites.