The theory is not that Facetime is using this API but that another malicious app is using it to take pics without the user consent.

Then Facetime is loading those pics on startup because they were the last pic taken with the phone.

Hmm, okay, but doesn't that sound kind of strange too? Why would FaceTime use an image from the camera roll instead of one from its own cache?

The linked thread says the image being displayed is not in the camera roll. so maybe some sort of weird caching issue?