If the user has the capability "read_private_pages" wp_list_pages() don't lists private pages in no way. I've noticed this problem by some comments on my "Role Manager" Plugin page.
Two patches are attached to this ticket.
wp_list_pages() gets a new option "include_private_pages". The default value is 1 for lists private pages too if the user has the capability "read_private_pages".
If private pages should not be listed also if the user has the cap "read_private_pages" the syntax is as an example:
wp_list_pages('title_li=<h2>Pages</h2>&include_private_pages=0');
The second patch is for get_pages() - with the same option and default value.
And of course: if a user don't has the cap "read_private_pages" private pages are listed in no case :)