Currently, it's not possible to use the configured Session Factory default schema in the query contained in the <subselect> element.

In the SQL native queries this is done using the {h-schema} placeholder, and the same technique could be used here.
I have tested an implementation, it only requires to replace org.hibernate.mapping.Table.getQualifiedName() with the following code:

public String getQualifiedName(Dialect dialect, String defaultCatalog, String defaultSchema) {
String usedSchema = schema == null ?
defaultSchema :
getQuotedSchema( dialect );
String usedCatalog = catalog == null ?
defaultCatalog :
getQuotedCatalog( dialect );
if ( subselect != null ) {
final String qualifyPrefix = qualify( usedCatalog, usedSchema, "" );
return "( " + subselect.replaceAll( "
{h-schema\\}", qualifyPrefix ) + " )";
}
String quotedName = getQuotedName( dialect );
return qualify( usedCatalog, usedSchema, quotedName );
}