Given these two classes (Parent in parentPkg, Child in top-level package):
The method staticParent() should not be callable via the Child class, because it is package-private to the parentPkg class. If in the top-level codepad you write "Child.staticParent();", you correctly get a compile-time error. But: if you right-click the Child class, you do see the method on the menu (the main bug). If you click it, no error is shown, which makes it seem like the method ran (which also seems like a separate bug to me).
This is fairly obscure for BlueJ, but it crops up in the Greenfoot rewrite (package-private static methods of Actor show up when right-clicking Crab & co) so it needs fixing.