Somebody Randi shared it with used the tag (or comment) feature, which then caused it to show up in the feed of Randi's friends-of-friends. Those people had no idea that the image wasn't public (because they don't directly know her), and simply assumed it came through a public feed.
Randi thought that one of her friends somehow shared the image, which wasn't the case at all. They were simply using a common Facebook feature. She clearly misunderstood what was happening. And she acknowledged her misunderstanding by deleting her twitter comments on the matter.
Directly from Zuckerberg's tweet:
""@cschweitz not sure where you got this photo. I posted it on FB. You reposting it to Twitter is way uncool," Randi said in her tweet."
It was reposted to twitter. Randi shared a photo on Facebook. This person was able to see it because she was friends with Randi's sister (friend of friend). The user then took the photo from a semi-private space and shared it publicly on Twitter.