Today I was playing around with Facebook's where you can test out their API.

First, you may want to logout of Facebook using the button there and log back in in order to get the "FB.login callback" Log message on the sidebar. Inside that, you'll see something like:

{
   "authResponse": {
      "accessToken": "AAAAAKvQdWksBAG8yLhVwqWyvgF2uu2eUahBQTZCPD5y2ilo2qZBbyjJ3DJRXDn4UONrVqAK28ZCSlouAtvdbxCc0ZAzQ0e8VbZBZCsdHmzUQZDZD",
      "userID": "12463924",
      "expiresIn": 5200,
      "signedRequest": "_ltfzUYHjPHyFZH6JnlbzVa-oejnPTud9aHK24eIWOc.eyJhbGdvcml0aG0iOiJITUFDLVNIQTI1NiIsImNvZGUiOiJBUUR2WU4tcTk4cW04X2xwbkg0LVU4Rk9YMUoxYVBmOUNMQkJPeEhlSGowQUZ3a2V6akRNWDlPNGExbkhkREZxT2laQVhWZW50aDRfd19EUk5uWm95NFlDYXFqWktweDZ1MDA5U2Fkc2hSUjQtWUdfUi05S21zY3F5RXlPTC1zbGRaVHBqZkRZS0lvdzFxYnJ2SjJteWxXYkd1dWFhY1h6U1FUWW8tc1V2Rm1oTU5fLV9xZzNxOXRadHJTSi1WdFRpUWciLCJpc3N1ZWRfYXQiOjEzMjE1NDc2MDAsInVzZXJfaWQiOiIxMjQ2MzkyNCJ9"
   },
   "status": "connected"
}

You should copy the accessToken in order to do further testing which requires a token. Most of the new API calls can be tested right in your browser. For example:

https://graph.facebook.com/search?q=Tomo&type=user&access_token=AAAAAKvQdWksBAG8yLhVwqWyvgF2uu2eUahBQTZCPD5y2ilo2qZBbyjJ3DJRXDn4UONrVqAK28ZCSlouAtvdbxCc0ZAzQ0e8VbZBZCsdHmzUQZDZD&limit=10&offset=0

That searches my account for users with the name 'Tomo', while using my token to authenticate. The token doesn't last very long and has definitely expired by the time you read this.

Now plug this code into the textarea.

<div id="profile_pics">
Profile pics here
</div>
<script>

// From an example

var profilePicsDiv = document.getElementById('profile_pics');
FB.getLoginStatus(function(response) {
  if (response.status != 'connected') {
    profilePicsDiv.innerHTML = '<em>You are not connected</em>';
    return;
  }



// JSON output from https://graph.facebook.com/search?q=Tomo&type=user&access_token=AAAAAKvQdWksBAG8yLhVwqWyvgF2uu2eUahBQTZCPD5y2ilo2qZBbyjJ3DJRXDn4UONrVqAK28ZCSlouAtvdbxCc0ZAzQ0e8VbZBZCsdHmzUQZDZD&limit=10&offset=0
var people = {
   "data": [
      {
         "name": "Tomo Coffee",
         "id": "100001851101897"
      },
      {
         "name": "Tomo Kiku",
         "id": "626405318"
      },
      {
         "name": "Tomomi Shiho",
         "id": "1755956208"
      },
      {
         "name": "Tomoman Bkk",
         "id": "1674446551"
      },
      {
         "name": "Tomori Moore",
         "id": "511540368"
      },
      {
         "name": "Tomomi Takihara",
         "id": "100001600551550"
      },
      {
         "name": "Tomohiro Morinaga",
         "id": "713242010"
      },
      {
         "name": "Onda Tomoyuki",
         "id": "100001455563427"
      },
      {
         "name": "Tomoko Okawara",
         "id": "100001514576923"
      },
      {
         "name": "Tomonari Kino",
         "id": "804330331"
      }
   ],
   "paging": {
      "next": "https://graph.facebook.com/search?q=Tomo&type=user&access_token=AAAAAKvQdWksBAG8yLhVwqWyvgF2uu2eUahBQTZCPD5y2ilo2qZBbyjJ3DJRXDn4UONrVqAK28ZCSlouAtvdbxCc0ZAzQ0e8VbZBZCsdHmzUQZDZD&limit=10&offset=10"
   }
}


var searchid = '1218273364';
var markup = '';

function genfn(i) {
    var fn = function(result) {
        //console.log(i); console.log(result); 
        for (var j = 0; j < result.length; j++) {
            if (result[j] == searchid) {
                Log.info('foaf search match', people.data[i]);
                markup = (
                  '<fb:profile-pic size="square" ' +
                          'uid="' + people.data[i].id + '" ' +
                          'facebook-logo="true"' +
                          '></fb:profile-pic>'
                );
                var profilePicsDiv = document.getElementById('profile_pics');
                profilePicsDiv.innerHTML += markup;
                FB.XFBML.parse(profilePicsDiv);
            }
        }
    };
    return fn;
}

for (var i = 0; i < people.data.length; i++) {
    person = people.data[i];
    FB.api({method: 'friends.getMutualFriends', target_uid : person.id}, genfn(i));
}

});

</script>

As you can see, I prefetched the results from searching "Tomo" and I set the id of a friend whose "Tomo" friends I wanted to find. This searches the results and filters for people who have the mutual friend 1218273364.

To go further, one should have controls for choosing the search term, automatically fetch search results and page through them to find more results, and have a control for choosing the mutual friend. This will allow you to search for mutual friends even if you don't have permission to view a friend's friends. Turning this into an app or Chrome extension is left as an exercise to the reader. :)