Just because you've set your Facebook profile to "Friends only" access doesn't mean someone who is not your friend can't see it. One of the most confusing aspects of Facebook's privacy settings is an area where you specify what information your friends can share about you through applications and web sites, even parts of your profile you made private.
By default, regardless of how private your Facebook profile is, your friends can share the following pieces of information about you, straight from the screenshot on the right: Personal Info (activities, interests, etc), Status updates, Online presence, Website, Family and relationship status, Education and work, My videos, My links, My notes, My photos, Photos and videos I'm tagged in, About me, My birthday, and My hometown.
This whole friends-can-share-private-things by default can lead to some awkward situations, like one I ran into last week.
I'm Facebook friends with my teenage nephew, who is friends with another teenage pal who I am not friends with. This pal has his status updates set to "Friends only" access, which means I can't see them. But, he hasn't changed his default "what friends can share about you" settings. So, my nephew "liked" one of his pal's status updates, and it showed up in my newsfeed, since my nephew and I are friends. I clicked on the status update, and by virtue of the like, I could see the status and the 50-comment conversation that followed between a handful of teens whose profiles are set to "Friends only" and who I am not friends with. Essentially I could see private posts that were never meant for me to see--I'm pretty sure my nephew would be embarrassed if he knew I'd read some of his comments directed at his friends. I felt like the invisible adult who'd stumbled into a middle school locker room conversation that clearly wasn't meant for anyone to hear but these teens.
The lesson? If you're using Facebook as a private place to just talk to friends, in addition to setting your profile parts to "Friends only", make sure you also hit up the what friends can share about me panel (under Privacy Settings > Applications and Websites > What your friends can share about you). This way, if you're a 14-year-old who is friends with your old aunt, she won't get to see comment threads that might embarrass you. (The sad truth is that most teenagers aren't spending the time to update their privacy settings, so things like this are just going to keep happening.)
For more details on the changes to what Facebook (and your Facebook friends) can share about you in light of Facebook's recent changes, check out my piece at Fast Company last week, Time to Audit Your Facebook Privacy Settings, Here's How.