I disagree with some people here. If this _was_ an exploit that had an attacker (as opposed to the various other explanations people are putting forward) then r

I disagree with some people here. If this _was_ an exploit that had an attacker (as opposed to the various other explanations people are putting forward) then reporting it to Google is obviously valuable to them, even if he is unaware of how to replicate the exploit. He would a) make them aware of the problem b) give them enough of a start to work out what is happening. So I'd suggest it is worthy of being rewarded if not by the exact rules of the program, at least by the spirit of it. However, I seriously doubt this is really what happened - he makes a lot of leaps without any corroborating evidence. I am very sure this isn't Google trying to 'screw' the guy.