I brought the issue to the attention of Facebook. I was told that the product development team addressed the issue last week. A Facebook spokesperson explained that the bug pulled images from other Timeline app images, and not from personal profile photos. Facebook claims the issue had no impact on privacy or security.

I have asked Facebook for further clarification of what happened, what was done to fix it, or what security and privacy concerns may have existed prior to the flaw being fixed. That response is still pending.