If you leave 256 or more transactions open, and take a checkpoint, and then try to recover to that checkpoint, the code that reads the snapshot for calling rollback-to-stable asserts. This is because the counter used is accidentally only 8 bits wide.
Note that to have 256 transactions open you have to configure more sessions than the default, but it's easy to do that.