As Kaspersky found out, it wasn't just scamware, but a trojan: the title would swipe the contacts after asking permission, send them to a remote server behind the scenes and text spam the daylights out of any phone number in that list.
ENGADGET: Spam-happy iOS trojan slips into App Store, gets pulled in rapid fashion