It's their button, why would they need the user to click it? I guess it could be clickjacking, but there must be an easier way to do that.
Because Javascript is allowed to do more, like show popup windows, if it happens in an onclick event of a button.