This happened to a friend of mine who is an ex-FBer, and he posted on FB about it, and a number of people from the FB team who worked on the mobile app piece of it confirmed that indeed no data had left his phone without him requesting that it be posted, but that they were going to make that behavior more clear in an upcoming release.
That is what I did, and it works pretty well in general.
It also has the advantage (for me) that you don't get any notifications.
I've been told other m.facebook.com wrappers like Tinfoil were affected by this as well.
Hasn't been a problem since I deleted the app.
http://ghostinfluence.com/the-ultimate-retaliation-pranking-...
Apparently the feature is opt-in and will be sunsetted soon anyway, but you can disable it.