Privacy has become a major concern in Online Social Networks (OSNs) due to threats such as advertising spam, online stalking and identity theft. Although many users hide or do not fill out their private attributes in OSNs, prior studies point out that the hidden attributes may be inferred from some other public information. Thus, users' private information could still be at stake to be exposed. Hitherto, little work helps users to assess the exposure probability/risk that the hidden attributes can be correctly predicted, let alone provides them with pointed countermeasures. In this article, we focus our study on the exposure risk assessment by a particular privacy-sensitive attribute - current city - in Facebook. Specifically, we first design a novel current city prediction approach that discloses users' hidden `current city' from their self-exposed information. Based on 371,913 Facebook users' data, we verify that our proposed prediction approach can predict users' current city more accurately than state-of-the-art approaches. Furthermore, we inspect the prediction results and model the current city exposure probability via some measurable characteristics of the self-exposed information. Finally, we construct an exposure estimator to assess the current city exposure risk for individual users, given their self-exposed information. Several case studies are presented to illustrate how to use our proposed estimator for privacy protection.