100% correct! The only thing I'd point out is that IE's system will disable all scripts on the page if it detects an attack. For Facebook, that means the click

100% correct! The only thing I'd point out is that IE's system will disable all scripts on the page if it detects an attack. For Facebook, that means the clickjacking script will be stopped but the page will also be almost toally inoperable (due to the huge amount of JS that the site requires to function).