here is the relevant code:
http://git.php.net/?
p=web/bugs.git;a=blob;f=include/functions.php;h=2a8647c74ab99db00062b9060f1ab3ff
0e2cab6a;hb=HEAD#l1058

from that you can see that the private field has nothing to do with sending or 
not sending notification mails.
get_package_mail() has a clause which will force using the security@php.net as 
the default recipient list for a bug, but when you change the bug type from 
Security, that will not happen, and if there is a list_email set for that 
package in bugdb_pseudo_packages that address will be notified.
I think we should change the code to not send emails to the list_emails (and the 
currently hard coded $docBugEmail for Documentation Problems) if the private 
flag is set.
Apart from the security@ list there is only one package which has a non-public 
list_email which is PHP.net Systems Operation problem => systems@php.net.
And even for that list there is no reason to bother sending an email to that 
email address, because many of the people on that list doesn't have trusted dev 
or security dev access on bugsweb, so they couldn't see the bug anyways.

Would be nice if somebody could review my reasoning here before I commit it.

just pasting this from our irc conversation with philip and bjori:
if a bug (is private) AND (not Security bug type) AND (Documentation Problem 
bugtype OR it's package has a list_email address set which isn't a private 
address) then it will post notifications to a public list

This is most certainly neither a documentation problem nor a
translation issue.