See - 202666.pdf
"x x x.
It is well to emphasize at this point that setting a post’s or profile detail’s privacy to “Friends” is no assurance that it can no longer be viewed by another user who is not Facebook friends with the source of the content. The user’s own Facebook friend can share said content or tag his or her own Facebook friend thereto, regardless of whether the user tagged by the latter is Facebook friends or not with the former. Also, when the post is shared or when a person is tagged, the respective Facebook friends of the person who shared the post or who was tagged can view the post, the privacy setting of which was set at “Friends.”
x x x."
