Facebook must be one of the only large sites that hasn't been hit directly with serving malware, closest I can recall are incidents like this:

http://www.f-secure.com/weblog/archives/00002172.html