My main concern here is that the positions are often reversed -- in this instance a company used an individual's content in a friendly, appropriate way, and did ask permission before any standard commercial use. Usually an individual is using a corporation's content in a friendly, appropriate way and is forced to desist.
I'd rather see more sanity in IP rights and look at specific instances than broadly apply some one-size-fits-none legal interpretation. I'd also rather the discussion be about practical concerns in (public) sharing on social media; any image tagged with popular terms and public is out of your control regardless of IP enforcement. My point is more that the chain of events is predictable and will continue to happen, so rather than attempt to enforce a virtually-meaningless copyright on a photo tell people this is normal and be mindful of what and how you share your content.
"...posted it to their website with other UGC content. It was only much later that Crocs sought explicit permission..."
And that's unacceptable. The TOS of these sites with embeddable content have content creators licensing their creations for embedding, provide attribution when embedded correctly, and generally attempt to be fair in the arrangement. Explicitly taking content from any place online simply because it was publicly accessible and dropping it into your site without the proper embedding code is not acceptable. It doesn't matter that there's a mention of a hashtag that the company's marketing department encouraged the creator to use.
IANAL, but AFAIK having a trademark (in what jurisdiction?) does not confer the ability to appropriate others' IP even if they used your trademark. At best Crocs, Inc. can probably censor uses of the #crocs hashtag.
If she had snail-mailed Crocs, Inc. her photo with nothing else but the caption she wrote on Instagram, it would not give them a license to copy it! I feel like a broken record at this point... I agree it would be bizarre, and some people's social media behavior like this case is bizarre, but it would not justify them reproducing it without her permission.
They reproduced it on their own website, which is different than retweeting or whatever analog Instagram might have. Honestly I'm not sure exactly where I draw the line, especially given I don't know all the nuances of social media's features and etiquette, but rehosting crosses the line.
(I don't typically defend IP law as it exists today, but as long as it remains the law, I will when rich corporations try to trample lowly individuals' IP rights.)
[0] Edit: In the spirit of IP attribution, I will note I did read another commenter's post here about crocodiles and have probably derived this scenario from it. :)