Oh come on. This is such a corporate PR stand. The guy had taken the perfect step by posting the exploit on Mark's wall. He tried twice with best way available to him to report the bug. Is Facebook saying he should have adhered to a particular way for doing a service to them? Good luck in making him paint in the bad light. Next person will simply upload the video on Youtube and won't even bother reporting anything.