yeah it might be risk. but I am pretty sure it won't hack your facebook account
cause it doesn't even use relevant Cookies/Third party server address/form submit (to a third party server). to send request to any site, it should use document.formxxx.submit();
then the server can capture whatever...