This is probably closer to guessing someone's phone number than their password.

I wouldn't bet jail time that a judge sees it that way.

Well, the question is, how far does that go? If I put up photos on a public web server intending them to be private, is that still legal?

It goes as far as is reasonable. The law gets interpreted in a court of law by human beings that make decisions about whether a reasonable person would expect that to be private and the intent of the person that found the images anyway.

Here's a good writeup of the state laws, http://law.jrank.org/pages/11804/Computer-Crimes.html

  It is not enough for purposes of these laws to accidently or
  unintentionally wander into areas on the internet where valuable
  or secure information may reside. If one enters such an area
  using computers or computer technology, his/her intent must be
  to steal, destroy or defraud to be found guilty of a crime.

For example, David Kernell was convicted of "misdemeanor computer intrusion"[1] for accessing Sarah Palin's Yahoo! email.

[1] http://www.esecurityplanet.com/headlines/article.php/3879756...

Given Facebooks history at accidentally or intentionally making 'private' material quite public, what would a reasonable person expect? A well informed one, anyway.