This is really dishonest of Facebook. Most people will have a reasonable (but incorrect) expectation that if a user can't see a friend list on their profile page then Facebook will stop that user from accessing that information. Why else would Facebook provide a tool that lets you see how your profile appears to other people?

Facebook should properly authenticate access to the URL given in the post, and reenable blocking all applications. That is, actually respect people's privacy, not just patch things up to superficially look like it.