Image 1 is at fbcdn-photos-a.akamaihd.net
Image 2 is at fbcdn-sphotos-a.akamaihd.net
The crossdomain files are identical:
https://fbcdn-sphotos-a.aka
This worked for me:
loader.load(new URLRequest("https://graph.facebook.com/" + user.uid + "/picture?type=normal"), new LoaderContext(true, null, SecurityDomain.currentDomain));