I wrote a post explaining what to do to have user pictures show in the Sametime classic client and in the Sametime web client, here .
In a case, I found that the pictures did not show in the web client, so I opened a case with HCL Support. After debugging the problem, the great Trevor Tallackson found that my browser was trying to open a file that had a _tmp in the name
while on his server it was requesting the correct file with a .jpg extension
The solution is to delete the content of the temporary directory that the Sametime Proxy uses to store people pictures.
After doing that, I logged in again from the web client and the pictures were shown correctly.