https://en.bitcoin.it/wiki/Change
I'd like to suggest applying two additional options (as B & C in the following) for users to choose from in the bitcoin client:
A. When sending the change, generate a new address (in the default the first 100 addresses are generated in the current keypool beforehand), and send the change to this address (the current mechanism).
B. When sending the change , choose a random address from the current keypool, and send the change to this address.
C. User can choose an address from the current keypool (must from the current keypool) as the receiving address which all the changes will be sent to.
When user choose B or C, the backup of the wallet.dat will never become invalid since there will be no newly generated addresses beyond the current keypool size.
Deterministic wallets solve this too.
A wallet which is banned from creating new addresses would also achieve the same thing. You press a button and 500 private keys are generated and then you backup that wallet.