I think a very common problem with OAuth (way beyond Facebook) is that people often underestimate the permission they are giving to a 3rd party. For example, if

I think a very common problem with OAuth (way beyond Facebook) is that people often underestimate the permission they are giving to a 3rd party. For example, if you use some email client to manage your Gmail, the email client would request permission to "manage your Gmail", exactly what you want, but that actually gives the 3rd party permission not only to read all your mails, but to send out emails on behalf of you.