If you look in profile.php for all the places where $vbulletin->url is set to user.php, you'll see a number of them. If you wanted to change it in that file you'd either need to edit the file and change them all, or else have a number of plugins that set $vbulletin->url and then did everything else the code does before exiting.
But another approach that might work is to use the hooks redirect_generic and header_redirect to try to catch it just before the redirect happens. (Those hooks are both in includes/functions.php so it might help to look in there to see what's going on).
For the redirect_generic plugin you'd need to do some sort of replace on the variables $js_url, $url, and $formfile to replace usercp.php with something else (and if you need parameters in the url, it will be more complicated). For instance you might be able to do something like this:
Code:
if (THIS_SCRIPT == 'private')
{
$find = "usercp.php";
$replace = "index.php";
$url = str_replace($find, $replace, $url);
$js_url = str_replace($find, $replace, $js_url);
$formfile = str_replace($find, $replace, $formfile);
}
and in the header_redirect plugin, something like this:
Code:
if (THIS_SCRIPT == 'private')
{
$find = "usercp.php";
$replace = "index.php";
$url = str_replace($find, $replace, $url);
}
Warning: I haven't tried this code at all.