Whitehat does not mean "I will responsibly disclose the vulnerability for as long as there's good money and rewards otherwise I will exploit it or sell it to someone else".
Facebook or any other company with bounty programs are not competing against the black market and trying to out-bid the bad guys by attracting the black hat hackers to wear a white hat and disclose the bug to Facebook for some money.
"we will only pay you if we feel like it"
Facebook isn't saying that. They are saying "we can not pay you because you violated our terms of service" which is truly an under-statement. It should be like "we can not pay you because you exploited the bug on our CEO's profile and another one of our users and have created negative PR and damaged our reputation"
But even if they did say "we will only pay you if we feel like it", as far as whitehats are concerned that should not change their incentives and behavior because, again, whitehats, by definition are not those who disclose the bugs for money and rewards.
If you are a grey/black hat only wearing the white hat when the money is good enough then Facebook is not interested in dealing with you in the first place.
The hacker could have created two accounts he owned and controlled, who are not Facebook friends. He could have used one to post to the other's wall. Viola, bug proven and bounty collected.
Facebook should not expect from whitehats the same standards of bug reporting of their QA department. Most hackers are self-taught, one of the reason they are able to think outside the box and find exploits.
The whitehat program's priority should be to FIND EXPLOITS so they can be patched. Not having every single hacker in the world expend hours reading TOS and instructions on how to properly report such exploit.
Here is a thought: pay him less for not following procedures, but pay him anyways. Or better: pay a bonus to reports that follow proper procedures.
Whoever made the decision not to pay this guy should check with Mark Zuckerberg. If Mark is still adhering to "the hacker way" he should embrace such clever ways of reporting exploits and invite any whitehat to test them on his or better, {the idiot who decided not to pay}'s profile.
Hacking and finding exploits requires thinking outside the box, by imposing rules and "terms of service" on them, Facebook might be defeating the whole purpose of the whitehat program.
Any exploit violates Facebook's terms anyways. By not paying, Facebook is telling the whitehat community "go ahead, do our QA for us, we will only pay you if we feel like it"