The second one person with your phone number as a contact downloads the Facebook malware app, they have given Facebook your phone number.