diff --git a/Src/Newtonsoft.Json.Tests/Bson/BsonWriterTests.cs b/Src/Newtonsoft.Json.Tests/Bson/BsonWriterTests.cs
index 49c531d7..0e438a03 100644
--- a/Src/Newtonsoft.Json.Tests/Bson/BsonWriterTests.cs
+++ b/Src/Newtonsoft.Json.Tests/Bson/BsonWriterTests.cs
@@ -625,5 +625,18 @@ namespace Newtonsoft.Json.Tests.Bson
 
       Assert.IsFalse(reader.Read());
     }
+
+    [Test]
+    [ExpectedException(typeof(JsonWriterException), ExpectedMessage = "Error writing String value. BSON must start with an Object or Array.")]
+    public void WriteValueOutsideOfObjectOrArray()
+    {
+      MemoryStream stream = new MemoryStream();
+
+      using (BsonWriter writer = new BsonWriter(stream))
+      {
+        writer.WriteValue("test");
+        writer.Flush();
+      }
+    }
   }
 }
\ No newline at end of file
diff --git a/Src/Newtonsoft.Json.Tests/Properties/AssemblyInfo.cs b/Src/Newtonsoft.Json.Tests/Properties/AssemblyInfo.cs
index 989d5e9d..813250c1 100644
--- a/Src/Newtonsoft.Json.Tests/Properties/AssemblyInfo.cs
+++ b/Src/Newtonsoft.Json.Tests/Properties/AssemblyInfo.cs
@@ -41,5 +41,5 @@ using System.Runtime.InteropServices;
 // by using the '*' as shown below:
 [assembly: AssemblyVersion("4.0.2.0")]
 #if !PocketPC
-[assembly: AssemblyFileVersion("4.0.2.13707")]
+[assembly: AssemblyFileVersion("4.0.2.13721")]
 #endif
diff --git a/Src/Newtonsoft.Json/Bson/BsonWriter.cs b/Src/Newtonsoft.Json/Bson/BsonWriter.cs
index 7975070b..4f7c4cbe 100644
--- a/Src/Newtonsoft.Json/Bson/BsonWriter.cs
+++ b/Src/Newtonsoft.Json/Bson/BsonWriter.cs
@@ -199,6 +199,9 @@ namespace Newtonsoft.Json.Bson
       }
       else
       {
+        if (token.Type != BsonType.Object && token.Type != BsonType.Array)
+          throw new JsonWriterException("Error writing {0} value. BSON must start with an Object or Array.".FormatWith(CultureInfo.InvariantCulture, token.Type));
+
         _parent = token;
         _root = token;
       }
diff --git a/Src/Newtonsoft.Json/Properties/AssemblyInfo.cs b/Src/Newtonsoft.Json/Properties/AssemblyInfo.cs
index c78177af..b1c274d8 100644
--- a/Src/Newtonsoft.Json/Properties/AssemblyInfo.cs
+++ b/Src/Newtonsoft.Json/Properties/AssemblyInfo.cs
@@ -110,7 +110,7 @@ using System.Security;
 // by using the '*' as shown below:
 [assembly: AssemblyVersion("4.0.2.0")]
 #if !PocketPC
-[assembly: AssemblyFileVersion("4.0.2.13707")]
+[assembly: AssemblyFileVersion("4.0.2.13721")]
 #endif
 
 [assembly: CLSCompliant(true)]
diff --git a/Src/Newtonsoft.Json/Serialization/JsonTypeReflector.cs b/Src/Newtonsoft.Json/Serialization/JsonTypeReflector.cs
index b53a9f16..e1f0857d 100644
--- a/Src/Newtonsoft.Json/Serialization/JsonTypeReflector.cs
+++ b/Src/Newtonsoft.Json/Serialization/JsonTypeReflector.cs
@@ -271,6 +271,7 @@ namespace Newtonsoft.Json.Serialization
             new ReflectionPermission(ReflectionPermissionFlag.MemberAccess).Demand();
             new ReflectionPermission(ReflectionPermissionFlag.RestrictedMemberAccess).Demand();
             new SecurityPermission(SecurityPermissionFlag.UnmanagedCode).Demand();
+            new SecurityPermission(PermissionState.Unrestricted).Demand();
             _dynamicCodeGeneration = true;
           }
           catch (Exception)