On "Step 1: Add Friends", it showed people who I actually know (presumably who have my phone number, since that's the only info I gave that actually relates to me)
On "Step 3: Profile Information", it offered many more people, most of whom I don't actually know (presumably friends of the people from step 1)
Note that to trigger the mobile-number-confirmation request, you may need to enter dubious-looking profile information. In my case, I entered a name like "Blaah Blahh", with a throwaway email address from www.mailinator.com. If your fake name is too realistic, it won't necessarily trigger the security check.
I do have the same mobile number on my primary account, so it's possible they found me that way. But either way, it's notable that in step 1 they managed to show just the people who I would expect actually do keep track of my phone number.
1) Apparently my cell phone number used to be registered to my primary account. When I created the fake account, it removed my number from my primary account and assigned it to the fake account. So what happened there was they suggested friends from the account that used to have the same phone number assigned to it. The creepy thing here is that it also suggested people that I had recently defriended.
2) I did the same thing, using my Google voice number which had not previously been registered to any FB account, and was suggested three friends who apparently have me saved in their address books.