ccINR

http://www.businessinsider.com/find-private-friends-lists-on-facebook-2014-6

Even if a Facebook user sets their friends list to private, other users may still be able to see part of that list.

http://blog.cyberint.com/2014/05/facebook-hidden-friends-vulnerability.html

The vulnerability allows attackers to discover (more precisely: reconstruct) the private Friends List of any Facebook user.