Hi!
I have a problem with Kamailio. Sometimes (can not catch the moment and conditions of) situations arise when, calling from AAA to uri XXX call comes to uri YYY. The call comes from PSTN to the gray subnet of user-agents registered in kamailio. As the PSTN we using Audiocodes mediant. 
Kamailio ver. 1.5.3
Mediant host: 172.19.32.2, Kamailio host: 172.19.32.3
XXX host: 172.19.32.33, YYY host: 192.168.1.203
I put a line in the log section route_branch: 
Apr 28 12:59:20 sipproxy /ks/sbin/kamailio[18294]: [INFO] new branch at sip:XXX@172.19.32.33:5060;user=phone

Then in the log module acc wrote: 
Apr 28 12:59:21 sipproxy /ks/sbin/kamailio[18302]: ACC: transaction answered: timestamp=1272473961;method=BYE;from_tag=1e76ae41;to_tag=1c1795565414;call_id=17
955646162422000234627@172.19.32.2;code=481;reason=Call/Transaction Does Not Exist;from_uri=sip:XXX@172.19.32.3;from_username=XXX;from_name=;from_domain=
172.19.32.3;to_uri=sip:AAA@172.19.32.2;to_username=AAA;to_name=;to_domain=172.19.32.2;request_uri=sip:AAA@172.19.32.2;request_username=AAA;route_id=;route_name=;route_type_id=;destination=;calllist_id=
Despite the error, the call passes, but to the another uri.
Here's the log of the mediant: 
1: 
Apr 28 12:52:31 172.19.32.2 (      lgr_flow)(44244101  )  ---- Outgoing SIP Message to 172.19.32.3:5060 ----
Apr 28 12:52:31 172.19.32.2 ACK sip:XXX@172.19.32.33:5060;user=phone SIP/2.0^M Via: SIP/2.0/UDP 172.19.32.2;branch=z9hG4bKac1897823584^M Max-Forwards: 70^M From: <sip:AAA@172.19.32.2>;tag=1c1795565414^M To: <sip:XXX@172.19.32.3>;tag=1e76ae41^M Call-ID: 17955646162422000234627@172.19.32.2^M CSeq: 1 ACK Contact: <sip:AAA@172.19.32.2>^M Route: <sip:172.19.32.3;lr;ftag=1c1795565414;vsf=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA->^M Supported: em,timer,replaces,path,early-session,resource-priority^M Allow: REGISTER,OPTIONS,INVITE,ACK,CANCEL,BYE,NOTIFY,PRACK,REFER,INFO,SUBSCRIBE,UPDATE^M User-Agent: Audiocodes-Sip-Gateway-Mediant 2000/v.5.00A.045.003^M Content-Length: 0
As you can see, in 1. all is well. But then:
2: 
.....  ---- Incoming SIP Message from 172.19.32.3:5060 ---- 
....From: <sip:AAA@172.19.32.2>;tag=1c1795565414^M Call-ID: 17955646162422000234627@172.19.32.2^M CSeq: 1 INVITE^M Allow: INVITE, ACK, CANCEL,OPTIONS, BYE, NOTIFY, REFER, MESSAGE, OPTIONS, INFO^M Content-Type: application/sdp^M User-Agent: Zoiper for Windows rev.1105^M Content-Length: 232^M ^M v=0^M o=Zoiper_user 0 0 IN IP4 192.168.1.203^M s=Zoiper_session^M c=IN IP4 192.168.1.203^M t=0 0^M m=audio 8000 RTP/AVP 8 0 101^M a=rtpmap:8 PCMA/8000^M a=rtpmap:0 PCMU/8000^M a=rtpmap:101 telephone-event/8000^M a=fmtp:101 0-15^M a=sendrecv
And that is where the substitution occurred at the data fields 'Contact' an entirely different user-agent (uri YYY), which is also registered on Kamailio. That it eventually comes to call. Repeat: In second SIP message from Kamailio 'Contact' field is replaced by 'Contact' of another (!) user-agent (YYY).

There is a suspicion that an error occurs in a block: 
if (!lookup("location")) {
            switch ($retcode) {
                case -3:
...
                case -1:
...
                case -2:
...
            }
        }
    }

I myself anywhere 'Contact' field are not affected, so all suspected to locate() from module Registrar.