http://www.facebook.com/ajax/report/social.php?
__a=1&
__d=1&
attach_additional_photos=1&
cid=((FBID))&
content_type=0&
h=((HASH BASED ON YOUR ACCOUNT))&
phase=6&
report_id=1&
rid=((FBID))
After you get that initial hash then you can swap out the CID and the RID and get everyone else (I tried it for 3)... it's pretty easy.
This issue is probably going to make mainstream news by noon.
I tried to follow this url format by using Chrome Developer toolbar after clicking on "report this photo" of a non-private photo to extract my account hash id, rid and cid of the interested person. It's a GET according to Developer tool.
I get this however,
for (;;);{"__ar":1,"error":1357006,"errorSummary":"Don't have Permission","errorDescription":"You don't have sufficient permissions to do that.","payload":null}
Sorry just got up ... anyway ... I got it through Firebug and was able to reproduce it in a FireFox Tab, so I assume it was a GET, although it may have been a POST; I didn't cURL the URL from outside the browser though; I'm sure you need cookies.
This issue is probably going to make mainstream news by noon.