If collection is created with router.field -parameter to define some other field than uniqueField as route field and document update comes containing route field updated using atomic update syntax (for example set=123), hash for document routing is calculated from "set=123" and not from 123 which is the real value which may lead into routing document to wrong shard.
This happens in CompositeIdRouter#sliceHash, where field value is used as is for hash calculation.
I think there are two possible solutions to fix this:
a) Allow use of atomic update also for route.field, but use real value instead of atomic update syntax to route document into right shard.
b) Deny atomic update for route.field and throw exception.