[jffry]

Just threw together a test case. X-Frame-Options does seem to mitigate the view-source attack: http://jsfiddle.net/GEynT/2/embedded/result/

[joshfraser]

To be clear, the hack is still possible without view-source. It just makes it easier and more generic of a solution.