Logged into a public project as its Manager, I can see "private" projects in the Add as Subproject dropdown in manage_proj_edit_page. After I add them, they're no longer visible (which is good), but they shouldn't ever have appeared there.

In my opinion, the dropdown should never even show projects that the user is not a manager of (why would a manager of another project have the liberty of calling my separate project a subproject of his?).