[stevensanderson]

I also reproduced something like this.

On "Step 1: Add Friends", it showed people who I actually know (presumably who have my phone number, since that's the only info I gave that actually relates to me)

On "Step 3: Profile Information", it offered many more people, most of whom I don't actually know (presumably friends of the people from step 1)

Note that to trigger the mobile-number-confirmation request, you may need to enter dubious-looking profile information. In my case, I entered a name like "Blaah Blahh", with a throwaway email address from www.mailinator.com. If your fake name is too realistic, it won't necessarily trigger the security check.

I do have the same mobile number on my primary account, so it's possible they found me that way. But either way, it's notable that in step 1 they managed to show just the people who I would expect actually do keep track of my phone number.

[AlexMuir]

Jackpot - the name is the trigger, possibly combined with an own-domain email address.

[mkopinsky]

I created an account with a fake name and mailinator email (after several tries where it rejected mailinator domains, it finally worked with bobmail.info). It asked me for my cell phone number to confirm, and when I entered the code it had quite a large number of "John Doe is someone you may know". These people are not all people who I'd expect to have my phone number saved in their phones. My phone number is linked to my primary account, but I don't think it is visible.

[mkopinsky]

Two addenda:

1) Apparently my cell phone number used to be registered to my primary account. When I created the fake account, it removed my number from my primary account and assigned it to the fake account. So what happened there was they suggested friends from the account that used to have the same phone number assigned to it. The creepy thing here is that it also suggested people that I had recently defriended.

2) I did the same thing, using my Google voice number which had not previously been registered to any FB account, and was suggested three friends who apparently have me saved in their address books.