Are we sure the security hole was limited to merely viewing your friends' live chats? Sure, the "review how your profile appears to another person" search box will only give you your friends --- but you can change the "viewas" id manually.

Edit: I see someone in the Techcrunch comments section posted what he claims to be Mark Zuckerberg's pending friends requests - Ctrl+F for "Random Jo - May 5th, 2010 at 3:04 pm UTC" ...