When a pass of CreateTransaction fails to select enough bitcoin to meet the nFeeNeeded the next pass through may select a far smaller collection of inputs.  Currently it will continue to use the old fee amount based on the larger set of inputs, which can cause a non-trivial over-payment.

This may be the cause of the behavior reported here: https://www.reddit.com/r/Bitcoin/comments/5ltw5n/bitcoin_core_v0131_sends_enormously_high_fee/

Long ago fixing this was tricky due to a catch-22 between signing the transaction and knowing how much fee was required.  But after #9465 the whole algorithm will run using a dummy signature, so when there is already a change output fixing up the fee after finding a sufficient transaction should be a matter of a ~2 line change.

bool LoadKeyMetadata(const CPubKey &pubkey, const CKeyMetadata &metadata);
    bool LoadMinVersion(int nVersion) { AssertLockHeld(cs_wallet); nWalletVersion = nVersion; nWalletMaxVersion = std::max(nWalletMaxVersion, nVersion); return true; }
    
    bool AddCryptedKey(const CPubKey &vchPubKey, const std::vector<unsigned char> &vchCryptedSecret);
    
    bool LoadCryptedKey(const CPubKey &vchPubKey, const std::vector<unsigned char> &vchCryptedSecret);
    bool AddCScript(const CScript& redeemScript);
    bool LoadCScript(const CScript& redeemScript);
    
    bool AddDestData(const CTxDestination &dest, const std::string &key, const std::string &value);
    
    bool EraseDestData(const CTxDestination &dest, const std::string &key);
    
    bool LoadDestData(const CTxDestination &dest, const std::string &key, const std::string &value);
    
    bool GetDestData(const CTxDestination &dest, const std::string &key, std::string *value) const;
    
    bool AddWatchOnly(const CScript &dest);
    bool RemoveWatchOnly(const CScript &dest);