I'm sure i had more than that! There's surely some problem with authentication.
How to tell your debug instance that you are, in fact, The Man?
>>> from AccessControl.SecurityManagement import newSecurityManager
>>> admin = app.acl_users.getUser('admin')
>>> from zope.publisher.browser import TestRequest
>>> request = TestRequest()
That's more like it.
You can also pass a request object to portal_catalog.searchResults, as in portal_catalog.searchResults(REQUEST=request,review_state='private').
You could also have used portal_catalog.unrestrictedSearchResults(...), as Gilles Lenfant pointed out. See Products.CMFCore.utils.CatalogTool.CatalogTool for details.