You can't just view anyone's private photos. They have to have been logged into facebook (have a session) and then go to your domain with the exploit.
And you could just send them an email, carefully tailored to target them, with a link to your exploit site.