I think you will find thats the case unless someone hotlinks the image. Facebook permissions work at the level of the page showing the image, not on the image file itself.
Exactly. HN discussed this a couple weeks ago:
http://news.ycombinator.com/item?id=1740271
I'd written:
Facebook operates web servers generating authenticated and authorized web pages. These pages are dynamic, generated per user, based on current privacy settings. These privacy-managed pages contain links to assets considered, by users, to be just as private as the page.
When the user changes privacy settings for the page, the linked assets privacy could easily be kept in line, as demonstrated by CloudFront CDN being able to support private content links.
Facebook's fault is that the privacy managed page links to public (non-privacy managed) assets, using links that do not respect the containing page's privacy settings.