As of iOS 5, contacts were stored in a world-writable SQLite database. An app that corrupted this database would break contacts for all apps, causing some apps to crash or misbehave, and no permissions were required. (I ran across this on my personal iPad on an app I was developing, after a fit of overconfidence regarding SQLite encryption and whitelisting vs. blacklisting.)