After migration and salvaging wallet, it returned the same addresses, presumably in the same order, my bet that's bug is related to key pool queue, it's developer job to determinate exact cause, I'm not going to look through every step to find exact line of code which cause this. My time isn't free and I'm not going to waste it on this, thanks. If someone has better explanation why it was happened and why addresses were reused, you can post your version of events.
Address generation is
deterministic on purpose. That is a
feature added to BTC wallets long ago. If you generate address #X from a new private key, it will always be the same address.
Holy smokes, dude. If you are going to review something, know your business.
[edit]
This is how you can take an old backup of a wallet and recover new transactions that produce their own change addresses.
I'm not talking about address generation, I said that the same address has been reused despite it had been used in transaction and shouldn't exist in the queue. Read carefully next time.