He got there in 2009. Facebook did run for a long time with a fairly "vanilla" setup, yes.

A hacker got ahold of their "index.php" in 2007:

https://gist.github.com/nikcub/3833406

It is decidedly not a tour-de-force of technical prowess, just typical old school "bag of functions in the same namespace" PHP.