The problem is that the Private attachments are not private in the dbase - they are stored as regular attachments, and are linked not to a thread, but to a PM - this is what needs to be added to determine who can view what ...
There is (btw) already a hack that displays a listing of all attahcments - take a look for the "Files List" hack ...
Nevertheless, good work!