What if someone else was offering $10,000 for Facebook bugs, so they could exploit them? This bug could probably result in more than $5,000 in damages to the Facebook brand.
The problem with valuing bugs at their damage potential is that the total damage potential of all bugs in any given product is almost certainly magnitudes greater than the total value of the product itself.
People always say this but where would you go to find such a buyer? If you could find someone who would purchase it from you, would you process to then sell it to them?
If you can't find a buyer and/or would most likely be unwilling to commit a crime, it's a moot point.
