This seems.. problematic. They don't do anything to verify you own the site in question. What happens when someone aims this at facebook.com?

When you try to run a test, they do in fact make you put a file on your site to prove it's yours.

Ah. I didn't get that far. I expected some instructions before hitting go.

I still see potential problems, though, with things like third party hosting that may not be so happy about you doing this even though they don't explicitly disallow it in their TOS. I can make a github pages site have the specified url, for example.