I think it's a good idea when there is no CVE and a don't fix status.

Before this practice in general you simply released the exploit and see if enough chaos triggers a fix.

If people can't be responsible, let's just create a mailing list, call it "full-disclosure" and post everything there.