By private I mean when I upload a picture and set the privacy to "only Bob" It makes me think that Bob is the only person who has access to this picture.
The words you typed were "sell private data." It is an inflammatory phrasing, that evokes clandestine exchanges of cash for information that users are assured is private. Since you apparently know it's bogus, please do your part in keeping discussions reasonable and stop spreading it.
FB will get a share of ad revenue from a 3rd party application that Bob installs. That application will have access to my picture that I set to "only Bob".
You can blame Bob for being the middle man, or me for not reading the fine print in the privacy policy, but at the end of the day FB is making money from "selling my private data"