a) Get X's FOAF data, parse the friends, then get the FOAF data for each of them. Advantages: uses the bot interface, no need to log in as X. Disadvantages: lots of HTTP requests.
b) Scrape X's userinfo, parse out the friends, then scrape their userinfo. Advantages: no need to log in as X. Disadvantages: strictly inferior to method a.
c) Require X to enter her password, and use getfriends. Advantages: uses the client API, single HTTP request. Disadvantages: ew, requiring passwords.
No matter which method is used, there will be caching of data.
I am not so emotionally committed to this project that I will be offended if anyone says "gee, that project is a bad idea." Someone said "Oh, it would be neat if" and I got interested. I think if the three options above are the only possibilities, I'll probably just skip it. However, I wanted to ask before I punted.