Well find_friends exploit is one of them - my favorite was one found by clever/you [1] which leaked _any_ user's phone number because they weren't validating auth tokens correctly. That's long since been patched, and rightly so - definitely more dire a situation than war dialing.

[1]: http://cleveryou.net/post/40537133131/oops-snapchat-flaw-lea...