Here's "the grey area" for me. Linking to a user's profile picture looks like this: http://graph.facebook.com/[uid]/picture?type=small.
I use this code to show the user's profile pictur, at several places throughout the site (where the content was submitted by that user). Anyone viewing the site can see their profile picture.
As far as I can tell from reading the docs, as long as I'm not sharing uid's with third parties my website is appropriately using their uid's.
This scenario sounds common to me, but I want to make sure it's ok for me to use uid's like this.