The question is not whether there is a reasonable expectation as to Facebook. The question is whether the person using the computer had a reasonable expectation of privacy with regard to the computer. IMHO.
Unauthorized access where a password is involved can be criminal. Further, Facebook has an email system, so a case could be made that you were accessing electronic communications, which can potentially be a pretty significant federal civil cause of action.
Is this a minor child? That might make a difference. Does the person live with you? That may make a difference as well.
The fact you are asking if its legal gives me the inclination that you either did this and wonder if you did something wrong, or you had this done to you and you feel wrong. That to me indicates that there was, in fact, some sort of privacy expectation at play here. Whether it was reasonable or not depends on other info you did not include.
I would tread very lightly if you are the browser. You really don't want to get caught up in allegations involving identity theft or interception of electronic communications.