Index: modules/profile/profile.admin.inc
===================================================================
RCS file: /cvs/drupal/drupal/modules/profile/profile.admin.inc,v
retrieving revision 1.12
diff -u -p -r1.12 profile.admin.inc
--- modules/profile/profile.admin.inc	21 Aug 2008 19:36:38 -0000	1.12
+++ modules/profile/profile.admin.inc	15 Sep 2008 17:33:11 -0000
@@ -269,6 +269,7 @@ Unless you know what you are doing, it i
   $form['fields']['autocomplete'] = array('#type' => 'checkbox',
     '#title' => t('Form will auto-complete while user is typing.'),
     '#default_value' => $edit['autocomplete'],
+    '#description' => t('For security, auto-complete will be disabled if the user does not have access to user profiles.'),
   );
   $form['fields']['required'] = array('#type' => 'checkbox',
     '#title' => t('The user must enter a value.'),
Index: modules/profile/profile.module
===================================================================
RCS file: /cvs/drupal/drupal/modules/profile/profile.module,v
retrieving revision 1.244
diff -u -p -r1.244 profile.module
--- modules/profile/profile.module	5 Sep 2008 09:25:52 -0000	1.244
+++ modules/profile/profile.module	15 Sep 2008 17:33:15 -0000
@@ -357,7 +357,7 @@ function profile_form_profile($edit, $us
           '#description' => _profile_form_explanation($field),
           '#required' => $field->required,
         );
-        if ($field->autocomplete) {
+        if ($field->autocomplete && user_access('access user profiles')) {
           $fields[$category][$field->name]['#autocomplete_path'] = "profile/autocomplete/" . $field->fid;
         }
         break;