As MillMan explains, they can get permission to fish if signers-up don't realize what they're allowing.
But the answer seems clear: a member can run a feature designed to find people they know on FB, using their email address book (for a web-based account). They probably don't realize (maybe are not clearly informed) that FB will store the addresses retrieved in a dbase.
So ...
If you are reading this the probability of your internetting becoming part of a file is ever so-slightly increased by talking to US citizens.
Straight forward Set Theory, in other words.
You don't know me.
STRANGER DANGER!!! Ad astra per aspera
You don't know anyone. En un viejo país ineficiente, algo así como España entre dos guerras civiles, poseer una casa y poca hacienda y memoria ninguna. -- Gil de Biedma
I am no one.
:-)