Of course it was a bug. It seems clear to me they were experimenting with some texting functionality where Path would notify users of things, it made it to production with bugs, and some subset of users got this terrible behaviour.
Never ascribe to malice that which is adequately explained by incompetence.
It would need to be about three bugs. First, there's the bug where users who say that Path can't have their address books get their address books sent to Path. Second, there's the bug where their servers think the user has photos that he does not have. Third, there's the bug where their servers think the user wants to share these photos with Path's list of phone-number contacts for that user.
This does not seem like the most likely scenario to me.
What are the reasons that make you so sure, though? To me, it's not clear at all just from the symptoms that it is a bug. It could just as well be a feature they're only testing out on 0.1% of the user base to see how their engagement or whatever improves.
Collecting and using my private info to, say, recommend friends in their UI is something I could imagine a product manager doing on purpose. Creepy, but you can see why they would think this is helpful. Spamming every number in my phone book with texts about photos that don't exist at 6am is not something I could imagine a product manager doing on purpose.
Never ascribe to malice that which is adequately explained by incompetence.