This has now been resolved in v2.0 of the Graph API, whereby calling /me/friends only returns the person's friends who are using the same app, i.e. you can no longer access a list of non-app-using friends.
https://developers.facebook.com/docs/apps/upgrading#upgradin...