In DocumentSourceBucket::createFromBson:
const bool groupByIsPrefixedPath = groupByField.type() == BSONType::String && groupByField.valueStringData()[0] == '$';
if groupby is an empty string, this accesses invalid memory - or in a debug build, fails an invariant in StringData::operator[]() as pos() > size().