Marco Arment, on the very thing I discussed yesterday:
Apple needs to change the Address Book API to require user permission first, like Core Location and Push Notifications do. I don’t care how many applications break as a result. Not requiring user permission to date should be treated as a security hole and patched promptly.
And he’s a developer using the contact API.