You need to trick an account into accepting three fake friends, since those users will receive the code to change the password. Hardly seems like obvious security flaw, more like a long, complicated piece of social engineering. Which is what all hackers do....
You need to trick an account into adding three fake friends as "trusted friends", a feature that most people do not know about or use. This is much harder getting someone to friend three fake accounts.
http://www.hackersonlineclub.com/hack-facebook-account