I was trying to figure this out myself, and found a solution that worked for me.
I found something claiming that the debian version of the c-client library (part of the imap library) was compiled with some option so it absolutely will not read an mbox file outside of a user's home directory. So without a recompile of the library, you can only give it paths to the mbox file that start from the home directory and don't contain any "../" in the path.
While I haven't verified the statement above myself, I did find that if I created a user and symlinked the mbox file to the user's home directory, I could set $bounce_mailbox=nameofmbox, and it worked fine.
What I did in the end was create a user for the bounces (phplist-bounces), and set their home directory to /var/mail, and now bounce processing works fine via mbox.