The site could be faking the chrome so it looks like a separate pop-up, when it's actually just a div. Most of us would smell something wrong because it wouldn't be quite right but you could get reasonably close for non-developers.
I went looking for sites using facebook logins and found this one just as the first unlucky example: http://www.nydailynews.com/login Once you know the browser and OS, it wouldn't be too hard to get something mostly like that pop-up into a div.
I went looking for sites using facebook logins and found this one just as the first unlucky example: http://www.nydailynews.com/login Once you know the browser and OS, it wouldn't be too hard to get something mostly like that pop-up into a div.