This is only PoC. Type smth like oijfowijefohwqe and your real handle on Facebook e.g. http://facebook.com/egor.homakov and see how detector works. It's pretty slow (6 seconds to be sure) history object is changed as soon as full page has been loaded.

In production exploit I could invent something for fast brute and history.forward(), but PoC is interesting on itself. And, yeah, you don't need to allow Popups in Chrome - because Popup in Chrome get opened in fact and nicely work in background. Just wait...