How I found a Remote Code Execution bug affecting Facebook's ...

I knew I had a XXE because when I told Facebook's server to open ... but since I knew just how I would escalate that attack to a Remote Code Execution bug, ...