The problem appears to occur only with "collection properties" with join different from "inner join" ("left join", for example).
According to my tests and debugs I was able to detect this situation:

• org.hibernate.hql.internal.ast.tree.FromElementType.getCollectionPropertyReference(...) calls on line 621 JoinSequence.copy() and JoinSequence.setUseThetaStyle( true )
• Some point calls org.hibernate.hql.internal.CollectionSubqueryFactory.createCollectionSubquery(...)
  • org.hibernate.hql.internal.CollectionSubqueryFactory.createCollectionSubquery(...) calls "joinSequence.toJoinFragment(...)"
    • at org.hibernate.engine.internal.JoinSequence.toJoinFragment(...) calls joinFragment.addJoin(...)
      • at org.hibernate.sql.QueryJoinFragment.addJoin(...) calls this.addJoin(...)
        • org.hibernate.sql.QueryJoinFragment.addJoin(...) tests

          if ( !useThetaStyleInnerJoins || joinType != JoinType.INNER_JOIN )

          , this is is equivalent to

          if (useThetaStyleInnerJoins && joinType == JoinType.INNER_JOIN)

          • Here, the test is not consistent for "collection properties" when using non "inner join".

My suggestion is:

1. I think the fix can be done creating a method "org.hibernate.engine.internal.JoinSequence.copyForCollectionProperty()" like that:

   	public JoinSequence copyForCollectionProperty() {
   		JoinSequence copy = this.copy();
   		this.joins.clear();
   		while (joinIterator.hasNext()) {
   			Join join = (Join) joinIterator.next();
   			copy.addJoin(join.getAssociationType(), join.getAlias(),
   				JoinFragment.INNER_JOIN, join.getLHSColumns());
   		}
   		return copy;
   	}
   

2. and change org.hibernate.hql.internal.ast.tree.FromElementType (line: 621) to:

   joinSequence.copyForCollectionProperty().setUseThetaStyle( true ),
   

As soon as I can, I'll send a pull request.