I was going to write about this vulnerability, but I think that the original report has enough information and may be interesting to someone who hasn't sent a report to Facebook yet. If you don't understand something, let me know and I will add the information at the bottom of the post or something like that.
I reported this vulnerability on August 18 2017. Looking for something interesting? Watch this or read these.