Isn't Socialist Millionaires vulnerable if Alice's and Bob's message are picked from a shared list?
The attack you are referring to is called an offline dictionary attack, which checks all possible values against a given transcript. However, the typical security notion for the socialist millionaires problem should forbid this attack. In fact, designing a protocol which is secure "except for offline dictionary attacks" is trivial: both players simply hash their input, with some public hash function, and exchange the outputs; if they are equal, then they own the same value; otherwise, they don't. Attacking essentially amounts to hashing all possible messages.

The protocol you describe is more complex, and it is in fact immune to such offline dictionary attacks; it's main purpose is essentially to avoid them. The error in your reasoning is the following sentence:


  He knows $h^{ab}$ and $h^{\alpha\beta}$ from two other DHKE's they did.  So Bob can raise one to the power of the other and get $h^{ab\alpha\beta}$.


This is not true: one can compute $h^{ab\alpha\beta}$ from $h^{ab}$ and $\alpha\beta$, or from $h^{\alpha\beta}$ and $ab$, but not from $h^{ab}$ and $h^{\alpha\beta}$. Computing $h^{ab\alpha\beta}$ from $h^{ab}$ and $h^{\alpha\beta}$ is equivalent to breaking the computational Diffie-Hellman assumption. In fact, under the decisional Diffie-Hellman assumption, $h^{ab\alpha\beta}$ is indistinguishable from random, even given both $h^{ab}$ and $h^{\alpha\beta}$. This is the observation that underlies the security argument for this protocol.