This is not wolf in sheep's clothing, it is wolf in wolf's furry clothing. Oauth access token is pretty much as powerful as a password, and it is being written to debug log here. Amazing how this code passed code review!
This was a similar issue with the CarrierIQ thing. Apps have to explicitly request this permission, and it's a strange one that should raise red flags unless it is explicitly intended for such a purpose.
Indeed, the app that the author links to - https://play.google.com/store/apps/details?id=com.nolanlawso... - under permission there's the READ SYSTEM LOGS.
Sadly a ridiculous number of apps demand it for questionable reasons (for instance https://play.google.com/store/apps/details?id=com.sirma.mobi... -> Why does a Bible need to read from system logs?)
Edit: Have this app, contributed some translations. This app is pretty popular across many countries and locales, meaning the crash reports are essential for good user experience.
The nice thing about the crash reporter case is that even if the crash report is ready-to-go the user still gets to decide whether or not to send it, so they still have direct control. Perhaps the right line would be an "own log" permission.
The author describes getting into other folks' FB accounts by having them log in on his own device. Not their own devices.
If a user had FourSquare (or Parse) installed during the time of the vulnerability, that exploit would've worked. Maybe hidden in an obscure (partly useful? Wallpapers of a hot movie at that time?) and simple app.
Although the user 'just' logged in to known apps and services on his very own device. So your argument about not entering credentials on random devices seems off to me. The one about not installing each and any application out there is correct and spot on, of course.
This statement presupposes that a code review took place.
OCD kicking in.