IE9 actually takes care of this to some degree. For example, try pasting javascript:alert(1) into your address bar and hitting enter: the Javascript is blocked. To bypass it, you need to paste part of the URL into the address bar and manually fill in the rest (specifically, you can't paste a URL starting with javascript: or vbscript:). To the best of my knowledge, IE9 is the only browser that implements this kind of protection.

Two thoughts:

1. Disabling Javascript execution via the address bar is not something Facebook is capable of doing, any more than a random web developer can disable your ability to view the HTML of a page. Protection at this level is up to the browser developers.

2. That being said, I believe these kinds of phishing attacks demonstrate a lack of understanding on the part of end-users regarding what javascript: URIs can do. It's hard to protect users from themselves. ;-)