worked for me. tldr: Facebook apps were leaking the access token via the android log cat which is accessible from any app installed on your device.
AFAIK this has been a problem for well over 2 years now.
AFAIK since Android 4.1 the READ_LOGS permission (needed for an app to be able to access logcat output) can no longer be granted to a 3rd party application... of course, there are going to be lots of devices out there running Android < 4.1.