...it's easy to imagine the creator of a malicious application enticing users with a seemingly legit app and then updating it with malware. No one expects Facebook to do that...
Maybe I haven't had my morning coffee, but I absolutely would expect Facebook to throw some garbage in like that. I love seeing my GPS fire up every time I launch FB, even though I've disabled location services within the app.
