There's an article on the guardian about private phone numbers being uploaded from facebook, and another over techeye.net on the same subject.
Firstly a quote from the techeye article:
Facebook doesn't warn users that they are uploading their phone's address book to Facebook.
And whilst the guardian article never says it happens automatically, it also doesn't lay it out that you have to explicitly enable that feature, and agree to the facebook app uploading the data.
I was pretty sure that facebook wouldn't be grabbing all your contact information without telling you, if they did at all, and that both articles were just pure scaremongering. So I fired up the facebook iPhone app, headed into my friends list on there, clicked sync and got the following screen:
Ok, so according to that text, they're just pulling down profile images and profile links from facebook and putting them in your address book against your contacts. Seems fairly harmless so far. So I toggled the top switch, to enable Contact Sync, and got the following screen:
Reading that, it's fairly obvious what data facebook are uploading (although a little ambiguous why), and it certainly isn't happening automatically. As it says, it uploads the "name, email address, phone number" from all your contacts to facebook, and pull down "your friends' profile photos and other info from Facebook".