Yup, very legit. The success rate depends on the users privacy settings.
So if a user has a public photo, a.k.a. The Profile picture, FPR will resolve that into a name, a direct link ... etc.
Now if a user has a different photo and is somehow locked down by the "Post only to friends" feature, that means you can't see it: 1. because you're not logged in and 2. You're not that persons friend.
so again i say, it all depends. Enjoy.
