How does iPhone toasting/bumping apps work?
I don't have the facts to back this up, but my guess is that when the app is open it's searching for other open apps on bluetooth or local wi-fi. Then perhaps the physical "clink" is registered by the accelerometer and its timestamp matched with your friend's app.

I don't think this is meant to be that serious of a thing in the first place, so there's likely not that much security (and it would totally kill the mood if you had to exchange passkeys or something in order to make a stupid Facebook post). Of course, the fact that the iPhone is a closed platform and the App Store is regulated is some measure of security--no one would be able to distribute an app that harvested contact information from the Toast app. The Toast app probably only shares when it's running and active in the front.