Bitcoin-qt change address implementation specifics

[jimhsu]

Hi,

I tried googling, but couldn't find the answer to this.

What is the specific pool of change addresses that bitcoin-qt chooses to send to?

Let's say that I have a population of addresses in my wallet of the following types:
1. Manually generated by "create new address"
2. Automatically generated, but hidden as a change address (used before)
3. Automatically generated, but hidden as a change address (unused)
4. Manually imported via importprivkey that are knowingly insecure (let's say this is a public paper wallet for example's sake)

Is there a chance of change going into any addresses of type (4)? If so, is there a way to remove that possibility from occuring?