[borlak]

You can't just view anyone's private photos. They have to have been logged into facebook (have a session) and then go to your domain with the exploit.

[tomjen3]

Most people are locked into facebook.

And you could just send them an email, carefully tailored to target them, with a link to your exploit site.