Even from the example link the post gives, I am neither friends with Mark Zuckerberg (who has a private list) nor Chris Hughes (who has a public friends list). In this instance I have not had to befriend anyone!
And given that FB has a history of just changing the default security for things without telling anyone, or making the defaults fully open/public, this is a little worrying!
It seems like this could be pretty easily fixed by just not allowing arbitrary usernames in the "and" parameter and instead using the currently logged in user.
It wouldn't fix everything, but it would mean you at least need to befriend someone in their network before being able to use this attack.
https://www.facebook.com/zuck/friends?and=ChrisHughes
And given that FB has a history of just changing the default security for things without telling anyone, or making the defaults fully open/public, this is a little worrying!