This really puzzles me. Many of us know that now with Facebook API v2 you can only get the mutual friends who also gave permission to use your app and have made their list of friends public.
Nevertheless, Tinder manages to show not only all (or most) of your mutual friends (not only Tinder mutual friends), but also show 2nd degree connections.
How in the world do the do this!? IF it is somehow hacking their way, is Facebook OK with this?
My best guess is that Tinder itself maintains list of friends to find mutual friends.
FB can return a list of friends that also use your app.
Given users A, B, C with your app installed:
Given A is friends with B and B is friends with C.
You can infer for user A and C that there is a mutual friend B.