I'm using private upload on several sites and can confirm that this works.  So no need to file a bug issue.

> At this stage I imagined that these settings would cause an uploaded file to go inside the `../private` directory. Nope, instead they go into public directory `sites/default/files`. Was my assumption wrong?

No. This is indeed what should have happened.  The weird bit is that you say that uploaded files (still) go into `sites/default/files`.  Where is Drupal picking up that from if you've set the private upload directory to be `../private` and selected the private upload method?

Just to make sure, I set up a site to your exact specifications. I.e. with drupal root in the `/demo/drupal` and the private directory in `/demo/private`  (where `/` is the Unix *file system* root).

I first tested it using the absolute path (i.e. `/demo/drupal` as the private upload directory).  That worked without a glitch.

I then re-tested it using the relative path to the same directory (i.e. `../drupal`).  That also worked without a glitch.

I also noted that Drupal threw the following error if I tried to input a non-existing directory as the private upload directory:
    
    Warning: mkdir(): Permission denied in drupal_mkdir()
     (line 2341 of /demo/drupal/includes/file.inc).
     The directory /demo/bogus does not exist and could not be created.

In other words: If Drupal lets use `../private` as private directory without throwing this error, your setup *should* be correct for private upload.

I am sorry not to be of more help.  It sounds as you're doing the right ting when setting this up, and I cannot see why it does not work.

What I usually do in cases like this, is to start with a fresh default installation of the core.  This usually works.  I then introduces modules one by one, testing after each, to identify the module that triggers the problem.