How about looking into paying this man for his honest bug finding work? The response from FB on this is disgusting.

    "We are unfortunately not able to pay you for this     vulnerability because your actions violated our Terms of Service.  We do hope, however, that you continue to work with us to find vulnerabilities in the site. 

  We have now re-enabled your Facebook account. 

  Joshua 
  Security Engineer 
  Facebook "