That depends, I suppose.
If photo.php?id=123
is a page showing the photo with an id of 123, then yes, it should throw a 404. 404 means that a resource was not find when it was expected to be found - this is semantically correct.
However, on the odd chance that your semantic intent for photo.php?id=123
was for it to be a page searching for a photo with the id of 123, then it's perfectly correct to return 200 with a message saying that no results were returned.
Ultimately, it doesn't make a huge amount of difference. I'm not very well acquainted with how HTTP response codes affect the way search engines index your page, but I suspect that 404's will not get indexed in the same way. You probably don't want the page being indexed if there's nothing to display.
TL;DR I would throw 404.