From what I've briefly seen, it just redirects you from the profile page to this URL: https://www.facebook.com/search/{{fbuid}}/photos-of https://www.facebook.c

From what I've briefly seen, it just redirects you from the profile page to this URL: https://www.facebook.com/search/{{fbuid}}/photos-of https://www.facebook.com/search/{{fbuid}}/photos-of where, as you can guess, {{fbuid}} is the id of the user. And yeah, you can view photos from users that you aren't friends with despite that by looking directly at the profile you couldn't view them.