Surprised that the well-paid developers at Facebook missed this vulnerability. Should inspire confidence on anyone who didn't get a job there. :-)