A security researcher has detailed how he found a way to find out *any* Facebook user's primary email address, regardless of their privacy settings, by exploiting a weakness on the social network.