You can have NAT rules which map packets onto the same range; the NAT code is clever enough to avoid clashes. Hence having two rules which map the source address 192.168.1.1 and 192.168.1.2 respectively onto 1.2.3.4 is fine.
Furthur more, you can map over real, used IP addresses, as long as those addresses pass through the mapping box as well. So if you have an assigned network (1.2.3.0/24), but have one internal network using those addresses and one using the Private Internet Addresses 192.168.1.0/24, you can simply NAT the 192.168.1.0/24 source addresses onto the 1.2.3.0 network, without fear of clashing:
# ipnatctl -I -s 192.168.1.0/24 -b source -t 1.2.3.0/0
The same logic applies to addresses used by the NAT box itself: this is how masquerading works (by sharing the interface address between masqueraded packets and `real' packets coming from the box itself).
Moreover, you can map the same packets onto many different targets, and they will be shared. For example, if you don't want to map anything over 1.2.3.5, you could do:
# ipnatctl -I -s 192.168.1.0/24 -b source -t 1.2.3.0-1.2.3.4 # ipnatctl -I -s 192.168.1.0/24 -b source -t 1.2.3.6-1.2.3.254
If the NAT code assigns an address to a packet, then a new packet comes along which is already using that same address, then the NAT code will try to reassign its source address (and possibly port for TCP and UDP packets) to move it out of the way, even if there is no explicit rule to NAT the packet. The port will be kept under 1024 if it is under 1024, otherwise it will be kept above 1024.
The NAT code always tries not to alter a packet if it can: if a rule says to map the packet onto a range it is already in, it will try to get away without touching the packet if possible.
It is theoretically possible that there is no free address: consider the case of an ipnatctl rule mapping all internal TCP packets to a single IP address and port, and two internal hosts connecting to the same web server. When this happens, like any network congestion, the second packet to attempt mapping will be dropped: eventually the first connection should expire, and the mapping can succeed on a future packet.
The NAT code has been designed for simple administration (ie. to keep this HOWTO simple); doing anything non-intuitive is considered a bug. I just hope my intuitive matches most other people's. 8-)