Who said that only professionals can find vulnerabilities? The guy is clearly inexperienced, but catching the bug is no lesser favor to Facebook. They are being dicks. And they deserve the bad press.