When any action is performed using the Hack code section of Facebook, it is done with a viewer context. That context contains the logic deciding if the associated piece of data can be returned. An example evaluation for the user context would be, "
if (post.privacy == public || post.privacy == friends && user.is_friend() || post.privacy == custom && user.in_custom_list())..."
The view as feature, when working properly, would assign you a viewer context that has the permissions of the user you selected combined with the restriction that only your own data is viewable.
This disclosure suggests that a logic flaw was introduced into the viewer context that's assigned for the view as feature which in some circumstances did not couple the special restriction that only the requesting user's info was visible.