Yes, the hash is "facebookcorewwwi", this is the hash of the public key of one of the keypairs facebook generated. We can't pretend to be facebook without knowledge of the corresponding private key, however.

To make this more clear, most tor hidden service sites that don't have loads of computing power to bruteforce a vanity domain have uris that look like http://3g2upl4pq6kufc4m.onion