How to test:
----------------
#! /usr/bin/python
import subprocess, sys

# will print err to sys.stderr
subprocess.call(['rmdir', '/no_such_dir'])

# will NOT print err to sys.stderr
subprocess.call(['rmdir', '/no_such_dir'], stdout=sys.stderr)
----------------

According to strace, in child process:
-----------------
dup2(2, 1) // that's what I expect, okay
close(2) // that's I was not expect, so bug here
execve(...)
-----------------

Bug is in subprocess.py:
(search for "dup2" in file)
I do not known how to fix correctly. Logick in this module is brain damaged in some places.

-----------------------------
# Dup fds for child
if p2cread is not None:
    os.dup2(p2cread, 0)
if c2pwrite is not None:
    os.dup2(c2pwrite, 1)
if errwrite is not None:
    os.dup2(errwrite, 2)

# Close pipe fds.  Make sure we don't close the same
# fd more than once, or standard fds.
if p2cread is not None and p2cread not in (0,):
    os.close(p2cread)
if c2pwrite is not None and c2pwrite not in (p2cread, 1):
    os.close(c2pwrite)
if errwrite is not None and errwrite not in (p2cread, c2pwrite, 2):
    os.close(errwrite)
-------------------------

patch (was not tested) attached

It's a duplicate of issue #10806, fixed in 2.7, 3.1 and 3.2.
Closing.

Why not to backport to python 2.6 ? this is the bug, not a feature.

Because 2.6 is in security-fix-only mode.