"Legal" tends to be used to mean two things: whether there is a law against an action, and whether an action is consistent with some agreement. In terms of laws, it is legal to sell an app, although there could be some country where it isn't legal for a user to buy the app. It is possible that a user could use the app illegally, but you are not held responsible for such misuse, so you do not have to rig the program so that only legal uses are possible (I can't begin to imagine how that could be done). As a service to society you could include some "warning" that the app should not be used illegally. If the app could only be used to infringe on copyright, there could be an issue of contributory infringement, but I don't see any way to argue that such an app is always infringing.
Then there is the question of whether you have an agreement with Instagram to not sell such an app. If the content is just "out there" unprotected (no login required), then you would not be using their service. I don't use Instagram, so for the sake of discussion I assume you would at least have to create an account and log in to obtain the URLs for the pictures – and since you have to agree to their terms, you need to know what they say you can't do. You should not imply that the app is "associated with the Service or Instagram", but that does not mean that you cannot say that such-and-such picture is publicly available on Instagram. If you are using their API in the app, there are conditions to be met, but if you're just manually harvesting URLs and sorting them somehow, that doesn't require the API. There are also restrictions on creating bot accounts, but I assume you didn't do that. Finally, they "prohibit crawling, scraping, caching or otherwise accessing any content on the Service via automated means, including but not limited to, user profiles and photos (except as may be the result of standard search engine protocols or technologies used by a search engine with Instagram's express consent)". That would mean that you have to hand-pick the URLs.
[Addendum]
As jimsug correctly points out and Napster shows, one should not conclude that software companies are immune to liability for contributory infringement. A crucial thing that distinguishes Napster from this hypothetical case is that Napster had actual knowledge of infringement, it could block access to such material, and it failed to do so. In Napster, there is little reason to believe that any material was non-infringing, and the primary reason for Napster's existence was to facilitate "open sharing" of commercially-exploited material. In the present hypothetical case, it is reasonable to assume that most material is non-infringing (the person posting such material warrants that they have the right to post the material and indemnify Instagram). As the Napster court affirms, supplying a tool enabling infringement does not create liability. It would be important to take corrective action if infringement is detected: the software should, somehow, have the capacity to respond to a takedown notice; but that take us out of the bounds of law and into the realm of how to write software. From Napster:
if a computer system operator learns of specific infringing material
available on his system and fails to purge such material from the
system, the operator knows of and contributes to direct infringement...
Conversely, absent any specific information which identifies
infringing activity, a computer system operator cannot be liable for
contributory infringement merely because the structure of the system
allows for the exchange of copyrighted material
