It goes as far as is reasonable. The law gets interpreted in a court of law by human beings that make decisions about whether a reasonable person would expect that to be private and the intent of the person that found the images anyway.
It is not enough for purposes of these laws to accidently or
unintentionally wander into areas on the internet where valuable
or secure information may reside. If one enters such an area
using computers or computer technology, his/her intent must be
to steal, destroy or defraud to be found guilty of a crime.
For example, David Kernell was convicted of "misdemeanor computer intrusion"[1] for accessing Sarah Palin's Yahoo! email.
Given Facebooks history at accidentally or intentionally making 'private' material quite public, what would a reasonable person expect? A well informed one, anyway.
