what's so surprising about this?
you can get list of valid emails and just run them through facebook search and you ll get names and profile URLs, both public information no matter what your security settings are.
nothing special about this
anywhere, but thats not my point.
the point is, that its the same as getting list of email addresses. and no1 would be surprised if i would publish list of emails but this list is suddenly security issue