I am running 0.91 build 1344, fresh off the website.
The offending debug statement was in my zdesktop.log file and it had this format:
2008-10-18 21:04:27,961 DEBUG [btpool0-8] [name=zimbra;ip=127.0.0.1;] request - <AuthRequest xmlns="urn:zimbraAccount"><account by="name">MYACCOUNT@MYHOST.COM</account><password>MYPLAINTEXTPASSWORD</password></AuthRequest>
I don't think that it is transmitting my password in cleartext to the zimbra server as I checked "use SSL" (which I don't know why that's not the default); this was stored in a local zimbra log file.