There is a lot of variability in SSL/TLS; for instance, when data must be sent, it is split over one or several records, and the implementation is free to choose the size of each record as it sees fit (within the standard size constraints). Modern implementations, in particular, tend to make a few very short records (with 0 or 1 byte of application data) as a protection against the BEAST attack. Also, every implementation supports only a subset of the hundreds of possible cipher suites. The bottom-line is that it is possible to distinguish implementations from each other (I do not know of a readily available tool which does that, but it does not look very hard to do).
Leaking which implementation is used is not a big issue by itself (although it tends to make people nervous). Anyway, if the SSL server is used within a Web server, identifying the Web server already yields definite clues about the SSL implementation (if the server is IIS, the SSL code will be the one from Microsoft...). Also, there are not so many SSL/TLS implementations out there; the attacker needs not guess which is used, he just has to try out all the exploits he knows until one works.
If you use an implementation which has "questionable features", then the issue is not that the attacker may know or guess that you use this implementation -- the issue is that you use an implementation with questionable features.