Even if you have set your list of Friends on Facebook to the most restrictive privacy setting offered (Only Me), that list may still be visible - dependent on the privacy settings of your Facebook friends. Information security consulting firm CyberInt has reported a work-around that can expose portions of your Friends list to anyone on the Internet by comparing your Friends list to that of a (potential) Facebook Friend.

If that Friend has a more relaxed privacy setting for their Friends list then the Mutual Friends you share will be displayed. CyberInt's Shay Priel describes it this way:

The vulnerability exists in the “Mutual Friend” section, in the following URL:
https://www.facebook.com/profile.name(Hidden Friends Profile)/friends?and=second.profile(Public Friends Profile)

Here is Facebook explanation about the Mutual Friends feature:

"Mutual friends are the people who are Facebook friends with both you and the person whose Timeline you're viewing. For instance, if you're friends with Chris, and Mark is friends with Chris, then Chris will be shown as a mutual friend when you're viewing Mark's Timeline".

So basically, if two users have mutual friends, these friends will be shown on Mutual Friends, even if one of them marked his\her Friend List as private (for no one else to see).

The ability to compare the Friends lists of two Facebook users and see the overlappping Mutual Friends could be a useful investigative research tool. You would need to know the Facebook usernames for each of the people about whom you are searching for information.

Priel has also created the Facebook Hidden Friends Crawler (for Linux) as "proof of concept." Non-linux users would have to manually construct the URL comparing the two users' Mutual Friends list using the URL schema above. 

Note, that if you're looking to lock down access to your own Friends list, this privacy setting IS NOT found behind the "lock and drop-down arrow" in the upper right-hand corner of your Facebook profile. To access this privacy setting you must visit your Friends page (https://www.facebook.com/UserName/friends_all) and click the pencil icon on the right-hand side, just above your Friends list.