What you point out here is a very implausible attack to perform. Not only would you need to know that the user is using this scheme to generate a password, you would also have to know how he generates the salt (maybe they use fb, or FACEBOOK or facebook.com). But then you'd have to be able to trick him into signing into some website with a name that's a subset of the aforementioned salt. Hell, even using FQDNs would fix the "problem" in most cases.

For the average user, a scheme like this would be a vast improvement over their "123456 is secure enough, no?"-scheme.

Putting the face/facebook start at the front of the passpphrase string would fix that. So would an HMAC.