I assume that user has the lowest access - "Read Any ..." (so public read in the ACL only).
Using .db.getProfileDocument - from my experience this will not work as they need a higher ACL access to get the profile document.
http://www.stevecastledine.com