One of the first things I'll do if I notice any unsanitized input causing problems is to find as many examples as I can of the broken/malicious data and use them as test cases while fixing the bug. Obviously I don't stop at what's already in the system, but it's a good starting point.

In other words, I wouldn't be surprised if Facebook knows now.