I... don't know about you, but if I were a blackhat hanging on to a XSS or CSRF bug in Facebook, I'd expect it to be worth a lot more than $500 on the open market. If it could quietly expose arbitrary user data, it could be worth tens of thousands easy; if it could arbitrarily change it, I don't even want to think about how much that is worth...