The reason that Facebook changed their policy to disallow targeting to a very small audience is because of this paper http://repository.cmu.edu/cgi/viewcontent.cgi?article=1066&c...

It studies the same problem as the author here exploited, but goes a lot farther to try and infer things about the targeted individual from the analytics that FB provides to the advertiser. The paper won the Privacy Enhancing Technologies award.

That was back in 2010. If the author succeeded anyway, it seems that Facebook was careless in their implementation of the fix.