Seems high-risk to me: All Facebook needs to do is set up a redirector that isn't at a domain considered "Facebook", and include a tracking ID in the redirector URL, and they'll be able to try and de-anonymize your non-"Facebook" container when your tracker-laden link opens in it.

The facebook extension by mozilla solves this: https://blog.mozilla.org/firefox/facebook-container-extensio...

That's not the current behavior, so I'd say it's been implemented.

There's an extension which does. https://github.com/stoically/temporary-containers