One of the comments explains it -- the mobile app uploads all contacts. So when he entered in his phone number, existing Facebook users using the mobile app were matched because they had his phone number in their contacts.
Facebook says that they save the contents of your address book, and that it might be used to suggest friends in the future: https://www.facebook.com/help/241275309301947/.
Suppose Alice and Bob are friends, and have each other in their contacts. Alice uses a simple, prepaid phone that only handles texts and calls. Bob has a smartphone.
Bob installs the Facebook app on his phone. The app wants permission to see his contacts, and he grants it. Maybe he's not paying attention, maybe there's a useful feature that needs his contacts, maybe the software asks the phone for permission, and the phone allows it without asking Bob. Whatever. Facebook now knows Alice's phone number.
When Alice gives Facebook her phone number to get a text (remember, that's all her phone can do), Facebook recognizes that it has seen this number before. Since Bob has this number, he is probably connected with Alice in some way.
Alice sees a recommendation for Bob when she logs on again.
Alice only gave permission for Facebook to text her. It didn't look through her phone at all.
> grants it. Maybe he's not paying attention, maybe there's
> a useful feature that needs his contacts, maybe the
> software asks the phone for permission, and the phone
> allows it without asking Bob. Whatever. Facebook now
> knows Alice's phone number.
IIRC the app simply doesn't install if you don't grant the permissions.
Facebook doesn't find my real friends. Well, the phone I have attached is a prepaid card I haven't given to anyone and I have no real friends in my phony FB account, so I guess there's no way they can find me.
If I had an account with real data I wouldn't link my phone to it. Not any phone that my real connections know.