Ah, right. I can see. The message you send back from your DB queries contains a msg._ui property already. But it isn't an array.
I think that is my fault. It is, of course, the output from the eventSend function and it is just an object not an array.
Perhaps I should have chosen a different msg property for the outputs.
Please delete the output msg._ui. Put a change node on the output from uibuilder. It should do 2 things. First, set msg.button (or some convenient property) to be msg._ui.id, then delete msg._ui. You can do that with a single change node.
NOTE: You may need to set the "deep copy" flag as shown above. Try without first.
Then your flow should work when you feed that into the uib-element node.
I have added a fix for the crash into the next release of uibuilder. I will also need to add a check to see if msg._ui.type exists - or maybe add another property to differentiate output _ui properties from input ones.
Well done for finding an important bug in uibuilder 
:
