A security researcher reported a vulnerability to Microsoft. But when the company didn't respond quickly enough, he went public with real exploit code.