Lesson learned: Find a security hole, report it to Facebook, and they don't respond after two attempts? Sell it as a zero day.
Incentives matter. And there is always money to be had somewhere else.