If I have a privacy setting for "friends only" on a picture and a friend shares it, can his friends, who are not my friends, see the picture on his timeline?
Despite the two answers given by others here to the contrary, the correct answer to the OP's question is, most definitively: NO! I just double-checked this myself, before posting this answer.
In general, when someone on Facebook shares an item to which he himself has access, he cannot "expand" the reach of that item beyond what the privacy-settings for that original item, by its original owner, allow!
So, for example, if the original picture, owned by user A, was located in an album that A shared only with his (A's) friends, then:
if B, who is a friend of A, shares that picture with "everyone" -- not everyone will actually see that picture. Specifically, C, who is a friend of B and also a friend of A, will see the picture. However, D, who is a friend of B, but not a friend of A, will not see the picture!
Moreover, even if D somehow gets access to the URL for this picture and tries to access it directly, Facebook will block his access to the picture!
Yes, you are right, someone who is not actually your friend would be able to see the photo through someone who is your friend's sharing of the photo.
Yaa, if your friend is sharing the photo, their friends will be able to see the shared photo. It's just like they downloaded your photo to their desktop and uploaded it on their profile to share it with the friend.
You can control who can see photos on just your profile not the web. If your photos really needs to be kept as a secret, don't upload it on FB, it's not a safe place at all.