I think it's understandable that Facebook want to be protected from the possibility that contributer X contributes code, and then sues Facebook for patent infringement, because the code X contributed was patented. This concern is well addressed by Apache license 2, there was no need for this custom license that goes too far.
The same reason Google has BSD + additional rights grants (though not as restrictive):
We deliberately want people to not be able to sue us for patent infringement without us being able to defend ourselves.
One can argue that facebook's method may be harsher than necessary (our rights grant is pretty much a copy of apache's 2), but i think people do not realize how often google/facebook/etc is getting sued for patent infringement.
Given how popular the software is, it deters people who are not NPE's.
This is critical though. Nobody is complaining about the Google (which is also used by Microsoft and Mozilla) retaliation clauses.
i think people do not realize how often google is getting sued for patent infringement.
Fair enough. If Facebook wants to make a public commitment to not use First Strike, the patent license would be acceptable. They have not, so it isn't.