I've had this bug with a facebook app I built.. I thought the flow would be:

  - Ask for permission
   - Yes? -> Good you're in.
   - No? -> Ok, np see you another day, maybe.

But what was happening is there was a third flow..

    - Yes (But I don't give you permissions!!). 

And that created a nasty bug later on in the app.

I don't think it's a "flaw" because you can accept the first perm. dialog as a user, but deny the second one (Asking for more permission). But, I believe it should be more explicit that developers need to verify permissions on every actions requiring them.