Videos uploaded as private or unlisted are subject to being crawled, but Google's documentation does not acknowledge this behavior at all.
Google is using optical character recognition (OCR) techniques to crawl URLs found in YouTube videos—including private videos—according to programmer Austin Burk, first reported by Naked Security. Burk found an XSS vulnerability in a different website, which he was reproducing using screen capture software as part of a responsible disclosure package. After uploading the video to YouTube, he found evidence of crawling activity with the user agent "Google-Youtube-Links" in server logs on a system he controls.
According to Burk, the URLs were visible in the address bar during the video, which was uploaded to YouTube, but kept unlisted. Burk then made a private video to test the behavior, which occurred in the exact same fashion as the unlisted video created for responsible disclosure.