What I find unclear is HOW they stole access token and what the video upload functionality has to do with it.
But that is not your question. You want to know how an access token provides access to the account of another user. This requires some knowledge on how a website authenticates you and gives you access. Session management explained here.
In a normal flow, you authenticate using a password, bio-metrics, etc. In exchange for a valid authentication, you receive a session id which is often stored in a cookie. For every other request, you add this session ID to prove that you are the same user as then one who authenticated successfully. An access token is basically a session identifier. It is provided to a user after successful authentication. The token can have a certain privilege level attached to it. This allows you to get a low privilege access token when using weak authentication such as password, or a high privilege access token when using stronger authentication such as bio-metrics. Probably, the view-as functionality provides you with an access token for a user other than yourself (the person you are viewing as). Due to some bug (unclear to me as well), this access token can be attached to other requests and result in a successful response.
- I authenticate.
- I get an access token.
- I fetch my profile and attach my access token as proof that I am the person who authenticated.
- I receive my profile information.
1. I view as my target user.
2. I somehow receive an access token for this target user.
3. I fetch 'my profile' but use the access token of my target user.
4. I receive the profile info of the target user.
The entire concept of tokens, SSO, session is more complex and I cut some corners. A session identifier often refers to a piece of information on the server which feeds access control with user attributes to base access control decisions on. An access token is often self contained, meaning it holds the user attributes possibly encrypted and signed.