So I've just been doing some testing with a friend of mine. It seems that Facebook allows users with the correct url to browse images sent via pm without authentication.
E.g. My Mrs sends a picture to her mum, if I have the correct link, I can see the image even though I don't have a Facebook account.
Case and point; below is a link to an image I sent to a friend of mine via PM. Also, I deleted my Facebook account 3 months ago!
Ran out of chars, see next toot for link...