Bug report on Zuckerberg's timeline, or: how to make one heard properly (khalil-sh.blogspot.de)

Note how he didn't get the bug bounty: after attempting to tell Facebook twice and got "nobug, wontfix" answers, his third (and successful) notice got answered with "We are unfortunately not able to pay you for this vulnerability because your actions violated our Terms of Service."

Great whitehat marketing on Facebook's side there.