Does the satoshi client always send the change of a transaction to a newely generated address? Experimentally, this seems to be the case, but is it always like this or depends on some details?
Also, does it generate a new address each time this is done, or first searches the wallet if there is an empty address there already? (And uses that in that case)
Is it likely that this behaviour will change in a later version of the satoshi client?
When you generate a wallet, then the wallet contains by default 100 bitcoin addresses. This is good for many reasons, e.g. old backups of your wallet might be able to recover all loses in case of a harddrive failure, etc.

The "privacy reason" is that someone looking at the blockchain can't see which bitcoin go to the receiver and which is the change of the inputs.

And last but not least, the "security reason" is because every bitcoin addresses is just a hash of a public key, so someone with a working quantum computer can't attack the public key (as he can only see a hash of the key, not the key itself). But whenever you need to spend bitcoins, you need to reveal the public key, so all addresses that have previously spend bitcoins will be "vulnerable" (but new addresses wont).