According to an answer to this question : Bypass app permissions, I changed by curiosity the application permission of Facebook and Messenger for the camera to always ask. I'm using CyanogenMod 12.0. Facebook was still able to open the camera without asking me. I then changed it's permission to Ignore, but still the camera opened.
Does anyone know why this is working and if there is anything a user can do against it?