Wouldn't it be a lot less disruptive just to disable that privacy feature that people use very rarely rather than disabling chat, which people use all the time? Unless, of course, they're afraid that this isn't the only security hole allowing you to see your friends' chats.

They disabled the button on the privacy setting page, but as of a few moments ago, this url still worked: http://www.facebook.com/[your short url]?viewas=[id]

Edit: The button from the privacy settings page is working again.

In general, though, cutting chat while trying to fix this is probably a Good Idea. Less room for bad things to happen assuming you can turn chat off more quickly than you can fix the behavior.

At least they seem to patch up things whenever bugs like this are discovered.

They want the privacy leaks to happen only through their APIs.

Is this a criminal violation?

If you mean on Facebook's part, no. If the user, then maybe.

Yeah, they'll deal with that fast but we've had a complaint/bug submitted for 3 weeks now and they haven't done a thing. I understand they must get a ton of these but as paying customers who rely on Facebook for key promotion you'd think they'd pay attention.

Sorry, just ranting a bit. It's been frustrating dealing with a company that doesn't have a telephone helpline, even for paying customers. (We've spent thousands of dollars on Facebook ads, etc.)

"Until we figure out the best way to market this 'feature' to our advertisers"