I realized that the new notes feature on Facebook pulling in an RSS feed references images at the original URL. For the non-techies, that means if you have an image in a post (say 1x1 "web bug" style) and someone looks at the note on Facebook, you see the request in your web logs. It just provides tracking, so not XSS like the other stuff that allowed changing profile data (which they fixed pretty quickly). I'm curious if they'll try to fix this one.
The last time I tried, they also allowed direct linking to pictures which avoided the whole logging in thing.
That article requires a login (and bugmenot doesn't have any since it's not free).
Updated a bit as I made no sense in parts of it originally...