http://nakedsecurity.sophos.com/2012/02/20/jail-facebook-ethical-hacker/?utm_source=facebook&utm_medium=status+message&utm_campaign=naked+security

While his intentions may have been 'good,' he obviously missed the memo about how to do it, ethically (ie- get written, signed permission, and have your 'get out of jail' card.)  Just can't go hacking systems on your own, without legalities taken care of, and expect to NOT get busted...

Unsure, but if they do, they're probably like most others, and have restrictions on what parts of the site are in scope or not, as well as even finding a bug doesn't mean get in and then continue to go deeper.  They'd usually ask that you report your initial way in, allow them to fix, then proceed.

This kid found a bug, but then continued to dive deeper.  He's not doing scoped / contracted pentesting.