There've been some interesting articles on this topic in 2600 the past year or so. There was one (can't find it at the moment, will post a cite if I can dig it

There've been some interesting articles on this topic in 2600 the past year or so. There was one (can't find it at the moment, will post a cite if I can dig it up) about viewing the information in sealed profiles and another about using an XSS attack to spoof friends request confirmations. I don't recall much about the articles, but what I do recall are that, in each, the author noted that by the time he got the article written, the whole had been fixed. Facebook is a big system, with a lot of possible holes, but it seems to be run by folks who care about security and respond well.