Draw Muhammad Day isn't about us standing up against terrorists. It isn't even about standing up against Islamic fundamentalists. It's about blatant bigotry. I'd venture to say most (if not close to all) people who participated did so out of pure hatred and with complete ignorance. This certainly violates Facebook's terms.
Fighting hateful behavior with more hateful behavior is sophomoric. While I really wish I could be defending free speech here, there has to be a point where I draw the line. If Draw Muhammad Day was a peaceful, public demonstration where people where drawing the prophet hugging pandas and sniffing roses, this post would be quite different. Unfortunately, that's not the case. People where being intentionally hurtful on a publicly-accessible, corporate-owned website. Facebook did the right thing.
The real stupid thing here is the idea that she should not be free to say what she wants.
I think this is a case of "it depends." I think, for one, we need to come to a consensus on what sort of privacy you should be able to expect on a social networking site. Should you consider it private communication or public? And even if it is private, there are certain situations where it doesn't matter. If you work for the public and say or do something - in private or not - which puts into question your integrity or ability to perform your job, you should have no expectation of privacy unless that privacy is protected by law (e.g., attorney-client privilege). This counts doubly if you intentionally friend your boss or another employee and still post such comments.
On the other hand, for example, if your boss was trawling the Web and finds your comments because Facebook has poor privacy practices, you communication should be protected.
If you're not careful, you're going to catch something.