FTA: "Accessing a user's page from the list will also enable you to click through to friends' profiles - even if those friends have made themselves non-searchable."

I see your point about it not being a "leak" exactly, but I think there's something to be said for it exposing how ineffective Facebook's privacy controls are. Then again, anyone who expects to prevent something from being public information after telling it to all their friends isn't thinking things through.

Accessing a user's page from the regular directory will also allow you to click through to friends' profiles. This is nothing that wasn't already available.