It works well for the way a lot of people use facebook, and very poorly for the way some people use facebook. There's a baked in assumption that you only "friend" people who you can identify from their photos.

(This one isn't a fake account, it's a "professional" account, so she's "friends" with a lot of people that she only emails for work purposes and has never met)

For a hilarious example of how this can fail, a guy I used to work with has a facebook account for his pet bird. It is friends with the pet birds of lots of other people. I was present on the occasion when he forgot the password to this account, and spent quite some time trying to guess the names of birds from their photos.

Facebook has a fallback authentication mechanism of showing them some government-issued ID (which could have worked for Violet Blue, and not for my colleague's bird).