From Facebook Developer Wiki

[edit] THE RIGHT WAY THIS SHOULD WORK

This Method is basically useless unless u can get attendees that haven't used your app. You can't even use the testing tools to pull results on this one. You can only pull results if you have an app that A) created the event and then B) the results will only be for the small and probably non-existent number of people that authorized your app. That needs to change, or how can you offer a user a complete list of his attendees of his own friggin event. Maybe rule A) above can stand, but rule B), definitely not. Rule A) should change to the app can pull attendees from any event a user attended or created and without a sessions, so long as the user has opted-in via the extended permission. That's the right way to do this.

James from FaceySpacey.com (email me at james@faceyspacey.com to discuss it)