Modern browsers (Chrome, Safari and I believe IE as well) include additional protection against reflected XSS attacks. These XSS filters work by scanning the document for any JavaScript provided in a query string which appears to have been written out directly to the page - usually indicating that the web application author forgot to escape some output somewhere. If the browser finds any reflected JavaScript it prevents that entire block of script code from executing.
Unfortunately this means an attacker can selectively /disable/ chunks of JavaScript by including them in a query string parameter. This is of particular importance with regards to clickjacking, where the most effective prevention measure is to use framebusting JavaScript.
Facebook avoid this attack by including a random string in a comment in that bit of the JavaScript which changes on every page view, preventing an attacker from predicting the exact JavaScript code and including that in a query string.