Take a look at the Profile settings of your account. Do you see the Apps link on the left?
There's on portion there that says "Apps others use"
People on Facebook who can see your info can bring it with them when they use apps. This makes their experience better and more social. Use the settings below to control the categories of information that people can bring with them when they use apps, games and websites.
Bio
My videos
Birthday
My links
Family and relationships
My notes
Interested in
Hometown
Religious and political views
Current city
My website
Education and work
If I'm online
Activities, interests, things I like
My status updates
My app activity
My photos
If you don't want apps and websites to access other categories of information (like your friend list, gender or info you've made public), you can turn off all Platform apps. But remember, you will not be able to use any games or apps yourself.
If your friends have that checked. I believe apps won't be able to get your friends' images through your access_tokens even if you have allowed the "friends_photos" permission enabled for the app that you're using.
I did an experiment and apparently I found that I must get my friend to also access the app to allow the app to access their photos under the "user_photos" permission. only then can I get their photos using my access token with the "friends_photos" permission.
Not sure if this makes sense to you.