Facebook is an interesting case, since they're a social network designed to not only allow users to post personal content up, but to share it with either their friends or the public. The service they provide is this ability to share personal info (like status updates, biographical info, work/school history, location history, photos, etc.) with others, and also for people to browse this collection of personal info through Facebook's social network.
So for Facebook to be allowed to do what they do, they need to get the user's permission to display the posted content to another group of users (which depends on one's social network and privacy settings).
That doesn't mean the user relinquishes the copyrights to their photo; it just means, by posting it, they give Facebook permission to publish the photo on their social network.
But Facebook isn't just a website. They also have embeddable widgets that anyone can put on their own webpage, as well as the Social Graph API through which this personal content can be accessed by 3rd party apps.
It would be impractical if, to display the profile pic of all the Facebook users who liked my page, I had to get each individual's permission first—likewise if I wanted to use the Social Graph API to make a mashup that made use of the user photos available through the API. So most-likely the Facebook terms & conditions also cover these fairly common contingencies.
As long as you're not saving and then distributing self-hosted copies of the photos, I think you should be in the clear. If the user doesn't want public access to these photos, then they can change the privacy setting on them to only be visible to themselves or to their friends. If Facebook's terms didn't allow hotlinking to the photos, then Facebook could've easily prevented people from doing so by checking the referrer address of each request, but they don't. Moreover, the fact that you can fetch the URL of photos through the Social Graph API suggests that they condone this type of use.