Just to clarify: you exploited said hole to access private photos of other people without their consent or knowledge?

What agreement they had with facebook I am unaware of. But facebook seemed to treat them as public.

Facebook and access have always been confusing and this is setup on purpose. Some photos show up in feeds some are available to other group members. Photos you think are private are private until someone else you know is tagged in them.

I not only have an ethical issue with what you just said, I also question the wisdom in disclosing your illegal activities on a public forum.

I wouldn't assume illegal activities occurred. Did you know facebook had an easy to access search feature for key employees to view anyone's private profile. All very legal.

As for the ethnical issues. I'm not sure I buy in. At one point typing profilename/photos showed you everyones albums private or not with a small picture. You needed access to go further. That's more of a facebook design decision. At least one private photo and the any album name were purposely not private.

Finding a bug and not reporting it is not illegal. The rest is assumptions.