It's not the first time either. Very similar breach of privacy happened when they implemented "view my profile as ..." functionality. You gained access to the private data of the user you were simulating.