You are absolutely right, and I apologize I didn't clarify. When you ask for second degree references -- always ask your candidate for permission before you contact them. In fact, when you ask the first degree references for additional references, you should make it clear you will get permission from the candidates.
First degree references usually have nothing but good things to say about the candidate, but you will get a much much more accurate picture from talking to someone who isn't on your candidate's top list.
This: In fact, ask the references for additional references.
... is actually pretty damn scummy. The candidate has no way of knowing who his shadow references are, and could get unfairly burned and left with no idea why. It'd only be morally acceptable if you asked the candidate for permission to call these second-degree references, but that would defeat the purpose of snooping.