Facebook's phone search can be abused to find people's numbers, researchers say