I doubt it's illegal, because posting a vulnerability that you found legitimately on Twitter isn't illegal. You might be dancing close to the edge by using Facebook's authorization to test their websites in an unauthorized way, which brings you back under the aegis of CFAA, but that seems a little far-fetched.

But whether it's legal or not, it won't work. Facebook will likely never do business with you again, but they'll watch your Twitter account for the free bugs you're promising to give them.