Facebook would probably just consider this a feature, but the rest of us will definitely consider this a big security hole.
The creator of http://guntada.blogspot.com (don't visit that site just yet) emailed us this morning to explain.
If you're already logged in to any Google account (Gmail, etc.), and visit that site, He's harvested your Google email. And proves it by emailing you immediately.