There is nothing wrong with doing it this way, just make sure you do some security checks.
As always, validate input from $_GET or $_POST.
However, nothing is going to happen if a user changes the query string to show his own picture. All it will do is change how it looks for that person. There is little to gain from it.