Months ago I customized my privacy settings so that some of my Facebook friends wouldn't be able to see my future posts. Yet, one friend I specifically put under "don't share this with" category liked the picture I posted yesterday. How is it possible? First off, we have no friends in common. The picture was on my timeline and it was not shared by anyone.
Apart from what's already mentioned in the comments, it is possible that you have a friend tagged in the photo and he saw it because the photo appeared on the friend's timeline.