While some of the more sensationalist parts of this were debunked, here [1] is the article that goes over a critical (non-technical) analysis of the binary itself.
The app uses some private Apple APIs, including capturing the SSID of your wireless network.
[1] http://motherboard.vice.com/en_uk/read/facebooks-messenger-a...