As Renesis said, the Graph API covers exactly what you need for the first three steps.
For the fourth point, I've been looking at the API extensively for my own apps and have found out how to do it via FBML with the following code:
<fb:serverFbml>
<script type="text/fbml">
<fb:fbml>
<fb:request-form
method='POST'
type='join my Smiley group'
content='Would you like to join my Smiley group?
<fb:req-choice url="http://apps.facebook.com/smiley/yes.php"
label="Yes" />'
<fb:req-choice url="http://apps.facebook.com/smiley/no.php"
label="No" />'
<fb:multi-friend-selector
actiontext="Invite your friends to join your Smiley group.">
</fb:request-form>
</fb:fbml>
</script>
</fb:serverFbml>
http://developers.facebook.com/docs/guides/canvas/#requests
It seems as though Scott's incorrect when he says Graph incorporates everything the old REST API has:
"We are currently in the process
upgrading our core server API from the
old REST API to the more modern Graph
API. However, most of the methods
required for canvas applications to
integrate with Facebook have not yet
been upgraded to the new API. For the
time being, we recommend you continue
using the old REST API in canvas apps
instead of the new APIs for the sake
of completeness."
(I can only post one hyperlink, so it's the same one as the #requests hyperlink but in the 'Making API calls' section)
Not sure if this is the case with other methods of integration such as web or desktop apps, but so far it seems as though the Graph API has a little bit of catching up to do!
Edit:
To list the profile pictures of a user's friend, use the following:
Assuming you've already got the current user's ID
https://graph.facebook.com/**USER-ID**/friends?fields=picture,name&access_token=**ACCESS-TOKEN**
This will provide a JSON object with a list of the current user's friends containing the UID, name and a link to the small version of the profile picture.
I haven't found a way to retrieve the large picture version in a search yet so with that method, if you wanted the large version, you'd have to iterate through each user and use this:
https://graph.facebook.com/**USER-ID**/picture?type=large