Not long ago I noticed an item in my RSS feeds (from Valleywag maybe). I can't seem to find it now or I would link to it.
The item discussed the lack of security on Facebook pictures. At the time I kind of dismissed it and moved on. But today I decided to investigate.
It turns out that access to pictures is not limited to your "friends"! In fact for many it seems not even login to Facebook is required! Sample from my Facebook photos:
http://photos-a.ak.facebook.com/photos-ak-sctm/genericv2/1433/87/01AwcAX0ZVBIgAAAABAAAAAAAAAAA:.jpg
I am not sure why this hasn't been reported further. It seems like a huge security/privacy breach on Facebook's part.