In order of desirability, the methods of dealing with a discovered exploit are:

1. Report to vendor and do not publicly discuss until they've fixed it

2. Demonstrate the exploit in public to prove that it works

3. Sell on the black market to Mafia/NSA/etc

The guy attempted approach (1), and didn't do a very good job of it, but it seems this was at least in part due to inexperience. Should he have worked more carefully to pursue option (1) first? Sure. But Facebook should have asked him for more information, perhaps pointing him to the guidelines.

So next he went to option (2). Facebook found the bug, and fixed it. Option (2) is infinitely better than option (3). I think Facebook should be extremely grateful to this guy - he even apologised for having to take this option in his post on MZ's wall, after (1) failed. Regardless of his & facebook's mistakes, they still should be thankful for him reporting it.