Vupen launched Zerodium fairly recently, which is a bug bounty program to do exactly this. Though I think they sell to other government agencies besides just the U.S.

Largest exploit type goes for up to $1.5MM: https://zerodium.com/program.html