Now I'm imagining the FBI using its facial-recognition databases and tracking down people who look like the phone owner to wave an iPhone in front of their face.

I'd watch that TV show.

"Dylan and Luke are bounty-hunters of a new breed. They have to find the long-lost twins of suspects on FBI's Most Wanted list. On this episode of Face Hunters..."

But you’d have to do it without it seeing people you don’t intend to test with. You only get 5 tries. You can’t wait too long or it will hit the timeout.

Sounds like a movie plot to me (I made a guess at one if you dig through my comment history).