Facebook failed to fully sanitize error data returned by a public facing web app.
https://threatpost.com/facebook-flaw-allowed-remote-commands/136987/