Clicking the div will click the underlying link, which will (if you're logged into facebook) "like" the Facebook Developer group.
Is this an issue with HTML5, or is it really an issue with how easy sites can manipulate your Facebook account?
It's like arguing that something is safer because it requires 10 lines of code instead of one to do the exploit. That's security by obscurity.
Unfortunately it simply isn't possible to provide something like the Like button without being vulnerable to click jacking. I assume Facebook decided that the benefits outweighed the drawbacks. There's probably something clever they can do on the server side to statistically detect and penalize likely clickjacking attempts.
Maybe our privacy settings are different and that's why you saw a prompt even though you were logged in.
http://shiflett.org/blog/2009/feb/twitter-dont-click-exploit
