Yea, Yea, cookies, we all (most) realise that one.

But prompted by a failure of a URL posted on Fakebook that went re-entrant. Where the process calls the same process (think subroutine ish) and either ends in a reciprocating loop or runs till memory runs out. I do something moderately clever with multiple subdomains pointing at the same loction & JavaScript reload() on lcms.mister.red

My interpretation of this is that links on FB posts are in truth still on their website and the target link is held in some kind of a <FRAME> (like a window without apparent borders). So everything you do from thereon in is accessible by Fakebook for trawling data.

Double checking any posted URLs on FB is the rule now! My advice to you.
Same here if you forget to add the http:// protocol.