I think you have to know certain things like the person's fb id, album id, photo id to construct the URL. Or you have to be able to view the photo on FB to get

I think you have to know certain things like the person's fb id, album id, photo id to construct the URL. Or you have to be able to view the photo on FB to get that URL. In either case, who ever distributes the URL already had access to the photo. So that's more about trusting your "friends" to keep what they see private than trusting Facebook.