I would have sworn I fixed this back in December...
Tested by running on -testnet and sending several transactions and verifying that the change output is random. Testnet txids:
f1c1db77e27c8d7a87cf27811daa18d4368fff0d02a8cbb1b7c615db48406459 2acb8b8899d8e4e16bd494d036bd27d5d6db78eee444993a36c4dc4d8c9a7a39 b9f7167522fe3cc2f07f137265589bf680fbaf4c9b3933f5ca7c511a83239932 94a98ad05e08c93758c861379da41617e8c5871d9052711c0a3efa87568b0266 72995c49c430ece98aeb9339ed106975c3fa5f1978890d89b38e51158531b6cb