There is obviously a spectrum to this sort of thing, but I know of many people that will just habitually enter javascript alerts into a web services's forms to see what happens.

Mostly this is just to evaluate the product and to see if it is trustworthy, but they'll often send along a polite FYI to the site owners letting them know if they have security issues that need addressing.

Actions like that: finding vulnerabilities, privately disclosing them, not disrupting the service, are all fairly innocuous things that most reasonable technically savvy people would consider 'white hat'.

Indeed. It's all about what you do as a result of your shenanigans. If you, say, leave a discrete note behind that you have a gaping security hole the size of a hallway on your systems, that would be considered white hat, as opposed to say, stealing a bunch of internal emails, code, etc and selling it or putting it out on torrent sites.

Facebook, Mozilla, Google, and lots of other companies encourage this with exploit bounty programs.

Yes. White hat hackers often approach these large companies' white hat programs themselves.