[carstimon]

I'm pretty ignorant of browser stuff, but couldn't the attack be even worse than mentioned in the article?

If the newly opened website has full control over the Facebook tab, can't the attacker directly modify the html in the opener to pop up a form asking for a password? This would be stronger because the address would not change.

Could the attacker reach into the Facebook tab and pull any information from it?

[paulddraper]

No. You do not have access to the contents of the window because facebook.com is on a different origin.

As this article says, you can change the location of the window.