Facebook failed to fully sanitize error data returned by a public facing web app.
Source: Threadpost