includes/functions_modules.php line 339

if (defined('IN_ADMIN'))

			{

				$this->module->u_action = "{$phpbb_admin_path}index.$phpEx$SID" . (($icat) ? '&icat=' . $icat : '') . "&i={$this->p_id}&mode={$this->p_mode}";

			}

			else

			{

				$this->module->u_action = "{$phpbb_root_path}{$user->page['page_dir']}{$user->page['page_name']}$SID" . (($icat) ? '&icat=' . $icat : '') . "&i={$this->p_id}&mode={$this->p_mode}";

			}

$user->page['page_dir'] contains an absolute filesystem path, this is not relative to the web root.
(see includes/session.php line 65)

this eventually gets passed to the U_ACTION template variable. if not IN_ADMIN, this value is broken. (we get absurd action urls such as: action="./var/www/phpbb/modsindex.php?sid=<SID>&i=196&mode=create" )

In the UCP this is dodged by populating forms with S_UCP_ACTION rather than making use of U_ACTION. I assume something similar happens in MCP.
(eg, includes/ucp

			'S_UCP_ACTION'		=> "ucp.$phpEx$SID&i=$id&mode=$mode")

perhaps generate_board_url() could be used here? or instead of {$phpbb_root_path}{$user->page['page_dir']}{$user->page['page_name']}, use

{$user->page['root_script_path']}/{$user->page['page_name']}

(note the slash)