Not doubting you, but I would love to see the methods to make this happen. Is your concern from a 3rd party script included on the page?

From my experience memory is safe between origins in the same way cookies are. And it is the dev's responsibility to not do something stupid with the token like window.FacebookToken = OAuthToken;. But that holds for traditional session cookies as well.