In order to view your facebook timeline and newsfeed, we need access to your address book. Please allow access.

Allow/Deny"

There's no automated capabilities-based OS-level permissions model that can protect against this. Accessing the address book is a legitimate app request - just not for Facebook Inc. in my opinion. But they can gate access to your timeline and friends by demanding it. And I guarantee you that 9/10 smartphone users will grant it. This is why you need curation and app store rules.