Tsk, tsk

Facebook ignored a nasty security hole for four-months, one of those that permits code-injection.