Evaluating an exploit, unless sanctioned by a bilateral agreement between both parties (like in pentesting), is in fact illegal in most countries. Disclosure without proper notification of the affected parties can also lead (and sometimes does) in a lawsuit against you.

I don't completely agree, but it's the prevailing point of view (and/or law) at the moment.