Viewing friend details of private users is not that difficult, it comes down to a simple url trick.
So long as the private user has a friend who has their friend-list settings as public, you can compare which friends they have in common using this url:
https://www.facebook.com/profile.name[Hidden Friends Profile]/friends?and=second.profile[Public Friends Profile]
This trick will reveal any friends the two users have in common.
In addition, if you visit a private user's profile, you will always see two things about their friends:
- Any friends you have in common with them
- A preview of up to 9 of their closest Facebook friends
Both of these are great sources for friends of the private user, in order to use the above url trick to compare them.
So there you have it, Facebook is a lot less secure than any of you think!