Acyd Burn claims to have fixed bug #1075, yes he has fixed an issue he found but not the issue reported.

Xore:

Eg. Say I'm invisible, because idjituser101z sends me annoying PMs when i'm online. idjituser101z puts me on their friends list, and now they can see if i'm online merely by loading ucp, even if they're on my foes list.

Steps to recreate:
= Install board.
= Login as admin, prevent people viewing online status (either in UCP or at login.)
= Create another account, say "annoying_user" (stayed logged in with the admin account.)
= Add "admin" to the friends of "annoying_user".

"admin" should appear online to "annoying_user" when view in the UCP friends list, effected code is in ucp.php.