The guy who noticed a bug In the FB android app and the messenger. 
What he noticed was that the pictures were being sent over the http protocol, and not https.
He actually emailed Facebook and they paid him a total of $2000.
Here, his original post