Looks like Facebook’s query API leaks more information than it ought to—and that with some clever combinations of searches you can reconstruct an awful lot of information about people even when their privacy settings are cranked to the max. Getting the platform privacy right for social software is so hard as to be impossible.
Hat tip: @cshirky