I initially reported (with my former nickname: Nemesis) this bug shortly after mIRC 6.03 was released (before the fire destroyed the former server of this message board). I'm reporting it again just to make sure that Khaled fixes it in the next version of mIRC.

It appears that $submenu over-evaluates the value (popup menu defintion) sent by the identifier that was used with it.

Here's a short but illustrative example:

Code:
menu status {
  Subtest 
  .$eval($network,0) $+ :blah ;This line shows that it isn't a menu bug
  .$submenu($subtest($1)) ;This line shows that submenu over-evaluates values
}

alias subtest {  
  if (!$isid) return
  if ($1 isnum 1-5) {
    if ($1 == 3) return $eval($me,0) $+ : $+ $1 ;$me is evaluated by submenu even when sent as plain text
    return $1 $+ : $+ $1 ;Value returned just so you can see where the bug is.
  }
}

As you might notice, the item "$network" is shown correctly in the menu, which means that mIRC respects $eval(,0) when it is used in menus; but it looks like $submenu doesn't because, even when $eval(,0) is used to send the menu definition value, the line is evaluated. In this example, the menu item should be "$me" instead of <your nickname> which is what it really turns out being.