How does Facebook spam work?

For example a friend of mine was just victim of this spam:

http://www.callingallgeeks.org/facebook-spam-alert-ive-added-smileys-to-this-comment-wanna-see-them/

Do you have any idea how they are implemented?

Not that I have any interest on doing it, just wondering if it’s those things called XSS vulnerability or whatever…

Thanks :)