Facebook changed how their API serves profile pictures that are requested with a non-application scope UID.
Now because before Graph API 2 all applications shared the original UID, if users like me has joined Stack Exchange websites before Graph API 2, rolling out their profile pictures are not shown properly.
Facebook suggests to use an access token to query those profile pictures, either an application access token or a user access token.
A user access token is not a reliable option at all, because it would only work for users who joined website with Facebook and are currently logged in.
Application access tokens, by the way, can be used by creating sort of a proxy that would retrieve a profile picture from Facebook and display it. Yet still it's not perfect.
I think the best solution is to communicate with Facebook and ask them to offer an opportunity to convert old Graph API 1 UID's to application scope user IDs.