After Facebook's new fiasco about its new "enhanced" and "simple" privacy settings, which resulted in setting most, if not all, pictures and information to be public!
What I found today is that even if you set your friend list to be private, it's still available to the public eyes, through a swift link.
To demonstrate, I'll show an example on Mark Zuckerberg, Facebook's founder.
Here's Mark's profile. As you can see, there's no friend list available to the public. but that's OK, going to this link will show the friend list! Tada!
In case they fix this problem before you can look at it, here're pictures:
The trick applies even to numeric IDs of users.