Down side is that I forgot to mention a different issue that I ran across when testing...
Files can be identified with CRC, sha1, and md5. The Rebuilder cares if the sha1 and md5 of a file doesn't match the DAT information. The Scanner, and the Scanner's "Fix Name" function, doesn't.
When I was testing, I for some reason rigged two files with identical CRCs, but different contents (and thus different sha1 and md5). I made a DAT for one of the roms. If I archive the other instead manually and stick it in the Rom directory and run a Scan, CMP looks at its CRC, sees the match, and decides that it is the proper file even though the sha1 and md5 don't match. If it has a different name, CMP decides it is the right file and just has the wrong name, and setting Fix Name will have it rename the file.
There is an Advanced option to test sha1/md5 for Fix Missing, but not to enable it for the basic scan, and not as a safety for Fix Name.
(Ah, I remember why I did it. I was trying to see whether the Rebuilder was actually checking the sha1/md5 of destinations when set.)
EDIT: I could have worded this report better. I meant to say that this was an issue from the start, not something introduced in one of the fixes.