Facebook allows the following variation of your passwords:

1. Your Original Password:Let us assume that you are using "breakTheSecurity" as password.  Yeah, you can log in with your default password ;)

2. Your original password with the case reversed(Toggle case):
This one will be interesting one.  You can toggle the case of your Password and use it.

For instance, your are using "breakTheSecurity" as your default password. In this password, 'T' and 'S' is Capitalized. 

if you toggle the password case, then your password will become "BREAKtHEsECURITY". 

3. Your original password with the first letter capitalized:

If the first character of your password is in lower case and you change it to Upper case, you can still login with this one.

For instance, the original password is "breakTheSecurity" .  In this password, the first character 'b' is in lower case.  If you capitalize the first character, then your password is "BreakTheSecurity".

The reason for 3 Passswords for your facebook account
It is not security flaw.  It is just feature provided by Facebook.

"We accept three forms of the user's password to help overcome the most common reasons that authentic logins are rejected. In addition to the original password" Zdnet quoted as Facebook spokesperson saying. " we also accept the password if a user inadvertently has caps lock enabled or their mobile device automatically capitalizes the first character of the password."

Three different Usernames:
1.  You can use your Facebook 'Username' as user name(if you have created)
2.  You can use your email address
3.  You can use use your mobile number ( if you have added your mobile number in Fb).