According to the manual, for the purpose of account matching for incoming connections user accounts are sorted in the order from most specific (no wildcards), to least specific (only wildcards). This is done in the get_sort() function.

But elements that have wildcards and only differ in the length of the tail are considered equal, that is the order of "%.bar" and "%.foo.bar" is undefined. Same for "www.%.com" and "www.%.host.com". Although in both cases the second host name is more specific and should be sorted first.

There is an attempt of fixing it upstream, but it's very incomplete