So, when the user clicks the “Continue with Facebook” button, the URL from the postMessage payload executes in the proxy iframe, which leads to the execution of the JavaScript on Facebook.com.

The $300 Million “Continue” Button Everyone gets exasperated by bad websites. But we think of those things as tiny annoyances, and assume that users will eventually get what they need.