If you click on the link, a "Not Permitted" page is displayed, when profile attachments are disabled for the user (even if you are trying to access it yourself). This is because the link is to the view attachments page for the user profile. If profile attachments are turned off, the permission manager determines that the user lacks permission to create attachments, and so returns not permitted for that URL call.

A fix might be to instead take the user to the "View Profile" page, which will show the profile picture.