Facebook only knows the contacts that match i.e. are already on Facebook. And that's exactly what the user wanted to find out.

It's true that they could store the hashes and build a graph of mystery contacts, but that's still not as bad as taking the actual contact info.