This falls under the Testing Scope and all parties in a penetration test should anticipate the discovery of protected data and private credentials in the course of the test.
YOUR defined expectation as the client should be the explicit and reasonable assurance that any garnered data and social media credentials will be used within the confines of the scope and remain private and in the custody of the penetration testers for the duration and a stated period of time after the test completion and solely for the purpose of documenting the results.
If YOUR particular environment allows an employees access to corporate materials via their personal social media credentials, THEN YES you should include that within the scope of the engagement. The pentesters shouldn't do anything illegal against the social media provider themselves and hopefully they already know that !
An explicit clause of effective destruction of your garnered data, private credentials and all any "trophies" and any other of your internal materials you advance them or they capture will be destroyed no later than an agreed upon date and with a well known and industry accepted data wiping method of your approval.
There is no contractual agreement that insulates your pen tester from illegal activity, if they behave foolishly, illegally with those captured social media credentials, they'll be subject to applicable legal consequences both civil and criminal. The client (YOU) will have no say in their prosecution.... if something like that ever occurred.