Under certain circumstances, the private images are displayed on the image strip on showphoto.php.
- the first photo of the image strip has to be a non private image
The next two photos are displayed regardless if they're private or not.
Code in showphoto.php:
Content visible to verified customers only.
As you can see, the "grab two more" part isn't checking if the image is private or not.