So for a query like "All Oracle employees who like sailboats and tennis", they check to see that the person has shared each of these facts with you, and only shows up if everything checks out. It's possible for you to be friends with someone who is an Oracle employee but they have only shared their employer information with a select group of people which doesn't include you. So they would not show up in that query you make.
The advertiser will presumably never see the actual profiles of the fb users, but they will know too much about the visitor(s) arriving from that Ad.
The post I replied to implied allowing "creepy" levels of targeting for Ads was not such a risk.
"Creepy" levels of targeting is pretty subjective. I don't think its creepy because the other side is essentially oblivious to who they're advertising to. I'd rather see no ads at all, but if I had to put up with ads, I'd rather see ads that advertise topics that I'm interested in rather than something that's completely irrelevant to me.
Of course, that's just my opinion.
The more specific the criteria, the more likely the "advertiser" is a spear fisher.
I can think of a couple exploits (Err- links) one might pay to send to "groups" like: All Oracle employees who like sailboats and tennis. All Universal Health Care employees who like Oracle. All apple employees who hate google maps.
The total cost of these 3 "campaigns" might be $30. You may hit these targets with a wider google campaign, but that would cost more and entail greater risk (i.e. people at mcafee who like nmap and Oracle.)