The point is, Facebook should complain about privacy in PR, because it implies that they care about it (whether or not they actually do care). Anyway, I think your points are pretty solid otherwise.
Whatever negative PR they cold pull for Google, it's much less than the heat they'll be getting for this ... and when you're taking risks, IMHO, you need to make damn sure those risks are worth it.
1. "Attacking the overlord" - People bash Google all day, every day; for privacy reasons and what have you. Seeing as Facebook is Google's biggest competitor and vice-versa, attacking Google doesn't seem to be a mistake. 2. "Bringing attention to Circles" - It's the "but THEY're doing it too!"-method fb is using when it comes to privacy and Google, plus, "we care about privacy". However, you forgot the main point: Nobody was supposed to know Facebook was the one behind the reports.
Unless they got caught, of course.