One would have thought that Facebook would have anticipated this sort of thing, especially given the already-large number of cross-site-scripting and other Java

One would have thought that Facebook would have anticipated this sort of thing, especially given the already-large number of cross-site-scripting and other Javascript tomfoolery attacks on it. (or, "this is why you can't have nice things.")