Correct, for Facebook.

Details: https://www.facebook.com/selfxss

Note that they have a checkbox on the above page where you agree to the downside, and the console is turned back on (and it appears to work just fine)