actually, what you've found is a injection in a third party app on Facebook

http://developers.facebook.com/

apps.facebook.com is the domain name, but that's not their data.