If two jars obtained from different classpath locations have the same name but different contents, one will overwrite the other. The dependency code correctly finds the jars (uses the full path in the HashSet which accumulates the deps) but when the bundle is created the jars are written to /lib under their name. This results in one overwriting the other.
While this is not a likely occurrence, it occurs for us in our development environment because our published jar names are built up from their project hierarchy. For example the model project for our sdk is in .../sdk/model and will be on the classpath as .../sdk/model.jar and published as sdk-model.jar.
In practice however this could occur with any jar name and would be more likely over time.
The ApplicationBundler could detect this and re-write the name with some part of the path or suffix to ensure the name is unique.