Worst that happens is he loses the domain name.
But, he may be able to pull it off.
UDRP says you can lose your domain name if you fall within all of the following categories:
1. The name is confusingly similar to someone's registered trademark/service mark.
2. You have no legitimate claim to the name.
3. You registered the name in bad faith.
#1 would be a slam-dunk for Sylvania.
#2, if your friend is actually using the site to sell those lightbulbs, then he does have a legitimate claim.
#3, if your friend is using the site and is not trying to extort money from Sylvania by trying to get them to buy it, then he will be ok here, too.
2 out of 3 ain't bad. It's been enough to shake off disputes before, but the UDRP judges are notoriously pro-big business.
Biggest piece of advice is this: If Sylvania offers your friend some nominal price to buy the name, DO NOT COUNTER OFFER. Simply state that "I am using the domain and it is not for sale."
If you counter-offer, they will claim that your "legitimate use" of the site is just a front - you just want to extort money from them, and you will automatically get killed on the "bad faith" thing.