The NodeUtil.getCollectionFromNodeIterator(NodeIterator iterator) converts the NodeIterator object to a Collection of Node objects. Unfortunately it uses a java.util.HashSet() for this, which totally mixes up the order of elements (see http://docs.oracle.com/javase/6/docs/api/java/util/HashSet.html). Quote:

"It makes no guarantees as to the iteration order of the set; in particular, it does not guarantee that the order will remain constant over time."

If you use an ArrayList instead of a HashSet, everything's fine.

Steps to reproduce the bug:

1. Create some more "Contact" records in the Data module
2. Create a new stkContacts component with this template:

[#assign contacts = cmsfn.search("data", "/jcr:root/contacts//element(*,Contact)", "xpath", "Contact")! /]
<ul>
  [#list contacts as contact]
  [#assign contactMap = cmsfn.asContentMap(contact) /]
  <li>${contact}</li>
  [/#list]
</ul>

3. Add the component to a page and reload the page a few times. Each time you reload, the order of the nodes will change.