I am sorry to have used your post as an example, but it's just ludicrous to expect everyone to know the rules. You keep deriding the reporter as lazy or lacking

I am sorry to have used your post as an example, but it's just ludicrous to expect everyone to know the rules. You keep deriding the reporter as lazy or lacking of simple things! His hack was lame; no one was hurt. Not even Facebook; nine 9s of their users don't won't know or care about such incidents. There's no telling that, had he used a whitehat account to repro the PoC, would they have paid any more attention; assuming the PoC can be performed on a whitehat account. It's not a stretch to think that a PoC against a real user should generate MORE attention. The point is, Facebook failed to educate the reporter. They can improve their process. As you say, the bounty is really immaterial; I don't even mention it. However, the system is not there to make Facebook's life easier; if they care to only handle and reward pristine reports, they have another thing coming.