This is the main reason I also use NoScript. Just today I saw two very tech savvy friends get caught out by a Facebook clickjacking attack. With javascript off on untrusted domains, it didn't work for me.