When the app is private to non-developers, the app can't get its own information from the server (if this used to work, it was a security hole that's since been closed).

The app currently uses Faceplate's app function, which returns the response from graph.facebook.com/<app ID>, for its own app_id, so if that response fails (as it does in sandbox mode), anything that uses the app_id (such as opengraph data or, crucially, the "Log In" button) will be broken (using "undefined" as the app ID).