They specifically allow accounts to be created for whitehat purposes at https://www.facebook.com/whitehat/accounts/
Interestingly, from that page:
"Please use a test account instead of a real account when investigating security vulnerabilities. When you are unable to reproduce a security vulnerability with a test account, it is acceptable to use a real account, except for automated testing."
"You will not provide any false personal information on Facebook, or create an account for anyone other than yourself without permission.
You will not create more than one personal account."