[ashearer]

It wouldn't even have to be stolen. All someone would need is access to the phone for less than a minute, which is harder to detect than if it was stolen outright. Though smartphones already have other privacy risks and are therefore protected, people with regular mobile phones weren't previously at risk, and probably have no idea that letting someone borrow their phone for a minute (or leaving it unattended) now means giving full access to their Facebook account, continuing even after the phone is returned.