Normally, when you give third-party apps permission to access your photos on Facebook, they can only see the images you've shared on your timeline. But this bug may have given those developers access to additional images, including ones you uploaded but didn't end up posting.
Source Link
