3.3V Regulator giving 4.8V with 5V Input
The dropout voltage is only "typically" 1.7V, there is no guarantee of how bad it can be other than that implied by the 40mA out at 5.3 in (so it's not a very good regulator for this application), but that does not explain why you're getting higher than 3.3V. 

Assuming it's the correct part number, and is not damaged, the simplest explanation is that \$V_{OUT}\$ and \$V_{IN}\$ are swapped and you're reading the voltage drop of a diode with very low current through it. Or the GND pin is not connected to GND. 



Note that the pin order on the TO-92 is reversed compared to the familiar TO-220 78xx regulators.