That shouldn't be a surprise. At an old job with far smaller user base, we used to do something very similar and while the shadow profiles were not materialized in the form of actual profiles, the amount of data you can gather about someone just by having his/her number pop up in the contact list of several of your actual users is staggering: full name, workplace, city/neighborhood where they live, their partners, their hobbies and all sorts of things which you generally should not know. And we are not talking people who have their entire life published online, but people with little to no online visibility. Assuming that facebook is not doing something similar considering that their main business comes from profiling and modeling user behavior is just naive.