The best will be chosen if things are not completely fubar'd inside NSS (the crypto lib tinymail uses).

The order in the #define doesn't matter.
Disabling SSL3 now would lock a lot of people out of their mail servers again, so while it would be beneficial from a security point of view, it would not help with the problem at hand.