Is what the other researcher did (collecting usernames and passwords) in scope? Is it impossible to use these credentials to get above standard privs on any part of facebook?
If the advice is bad and dangerous it would've been nice for the comment thread to still exist so I could've read the warnings and found better advice.