On a project at work, we’ve been doing a review of unnecessary permissions while we’re working towards adopting Android 6.0’s runtime permission model.
For instance, we had some app functionality which would immediately invoke a phone call (using ACTION_CALL), which requires the CALL_PHONE permission.