Sure, the guy's bug report was terrible. However, the blame is squarely on FB. It's the security team's job to follow up, and to ask for more information if they don't have all the details.

Contrast this with how Google responded when someone posted a Youtube video showing a Chrome exploit - they guessed that it was a Flash-based vector, collected millions of sample files and fuzzed for days to eventually discover the bug - based on a YouTube video that they could have also discarded as 'not a bug' based on lack of evidence.