What use is the social captcha if your friends list is public? Many people had this set because it was the new default when the settings switched some half-year ago. A lot of them probably don't even realize it.
1: Load the social captcha
2: Load your entire friend list
3: Look at the first photo of a friend, then examine every one of your friends (the average user has a couple hundred) and match them up, assuming that their profile photo is similar to the randomly-selected photo from the social captcha
4: Repeat this whole process two more times
Social captchas protect you against somebody from Nigeria hacking your account, and makes this process more computationally intensive. Even if they did login to your account after all this work you'd end up getting an email and SMS saying that there was a login from an unrecognized computer.
The example posted on the FB site looked like a multiple-choice selection was to be made, so the putative hacker would only have to look up those six friends, not look through all of your connections.