I think there actually is an issue. Even with correctly configured OAuth permissions in sandboxed mode!
Today, there are several endpoints that deals with followers.
self/follows
Example:
https://api.instagram.com/v1/users/self/follows?access_token=ACCESS-TOKEN
self/followed-by
https://api.instagram.com/v1/users/self/followed-by?access_token=ACCESS-TOKEN
Now, obviously the API uses the access-token to get the proper information. So, the only list it can return here is the list of users that the current authenticated user follows or is followed by.
In the previous API, there was an API endpoint that looked like this
/users/[user-id]/follows?access_token=ACCESS_TOKEN
This endpoint is still valid but works exactly the same as self/follows and self/following, that is, only useful for the current authenticated user. That is, in-sandboxed-mode! Will post if I can get passed the find folks at the Instagram review board. (This is I guess the only way to properly test this.) However, there are no documentation of this use of the API so it may very well not work.
This leaves us with the following API endpoints:
{user-id}/relationship
Example
v1/users/{user-id}/relationship?access_token=ACCESS-TOKEN
Again, this will obviously only return the status of the relationship between the currently authenticated user and the user with the user-id supplied in the url.