It's not very useful to compare bug bounty payouts to what the "black market" would pay for a vulnerability.
Let's look through the challenges of selling a vulnerability that allows for arbitrary account takeover (much more serious than this):
0. Find the vulnerability. Assume that no one will find it by the time you find a third party buyer.
1. Look for a buyer. If you're not well-connected, you might stumble into an FBI honeypot (a sting operation) because you don't know what you're doing. But let's assume you know what you're doing and you find a buyer.
2. You negotiate a price. You don't receive much more than Facebook would pay you (if they even give you that much) for a few reasons:
a. The vulnerability can only be used on Facebook, so it's not vendor agnostic (compare Heartbleed, Shellshock);
b. The vulnerability has an extremely small window of capitalization - it will be discovered within a week of use, maybe less. The Facebook incident response team is spectacular.
c. You need to figure out a sufficient monetization strategy for distributing malware or spam using profiles that are taken over using this vulnerability. You have a week of use, much less if you try to take over accounts too aggressively. Now you're going up against all of Facebook's other protections - once you have the account, spreading malware will either be algorithmically discovered by Facebook or reported by other users.
With an organized crime unit composed of professional hackers, this might pay off. Maybe. And that is for one of the most serious bugs you can find. You're better off just taking what Facebook (generously) gives you.
The classical fallacy people fall into is believing that a web application vulnerability is worth much, especially the variety most tech companies have to offer. It's certainly serious, yes, but it's only worth what a market will pay for it. It's worth a lot to Facebook for brand integrity. It's not worth a lot to hackers looking to make money.
The only web applications that might be worth real money would be banks or government institutions (or similar platforms). Real money is found in vulnerabilities on desktop clients, especially memory corruption vulnerabilities, or in ubiquitous software that affects servers. You want to be able to compromise a user for use in a botnet or distribute malware to steal their money or personal information. Alternatively, you want to be able to attack, say, 30% of the websites on the internet with a wide variety of options after you get in.
Examples include:
• Vulnerabilities in Flash.
• Vulnerabilities in Python, Ruby or corresponding web frameworks.
• Code execution in iOS that allows a jailbreak (most sources indicate the going price for this is $500,000). Other vulnerabilities as well, such as compromising app store receipts or in-app purchase checks.
• Vulnerabilities in Android, up to and including code execution.
• A game over flaw in any number of ubiquitous software packages used on Linux servers with root access.
• A sandbox escape in OS X or Windows (you'll be paid more for Windows but both are lucrative).