Hm, I think you can still invoke it jsonp style and overload the Object constructor in older browsers though, right? This would not only tell you whether they were a FB employee, but perhaps more importantly, their facebook UID without needing them to agree to any OAuth access.

That only works if it's surrounded by parenthesies. A bare object literal is not syntactically valid JavaScript.