This video should be pretty self explanatory. Gowalla gives users the option to make private passports (profiles) so that only their friends can see checkins (that way only your friends can track you down or rob you when you're not at home).
I originally found that all of the information to find a private users checkin information was trivial to obtain. I checked last night to see if Gowalla had fixed the issue (because they sure haven't communicated back to me, high-five) and sure enough on the surface it appeared as though they did.
About 5 minutes later (yeah 5 minutes), I realized they just masked the problem (removing the ability to have ultra accurate results). But stalkers don't really need ultra accurate results. It was still possible to find a user's checkins (twitter username, and friends list too), but you just have to be a bit more patient. With some basic guessing we can get close.
Enjoy the video. (thank you to Henrik Joreteg for letting me abuse his profile)
For a little history on this issue see some previous posts on the nGenuity blog
Decloaking Gowalla Private Passport + bonus (xss)
Gowalla location spoofing