If we $$DESCEND in redact, redact processor will create FieldIterator here:
https://github.com/mongodb/mongo/blob/04b6560034663dc4627d40015535077d5b89945e/src/mongo/db/pipeline/redact_processor.cpp#L103

FieldIterator iterates over DocumentStorage cache directly.
However, if redact expression contains something that will read a lot of fields from $$ROOT (for example {$objectToArray: "$$ROOT"}),
it will re-allocate cache when executing the expression for sub-document here:
https://github.com/mongodb/mongo/blob/04b6560034663dc4627d40015535077d5b89945e/src/mongo/db/pipeline/redact_processor.cpp#L87

This will make FieldIterator read freed memory.