Yep, these were the UAs we also saw (amongst others). And also in our case those bots were executing the JS, even hitting our Google Analytics.
For some reason GA reported this traffic to come from Peru and Philippines, while an IP lookup showed it belonged to FB registered in the US or Ireland
That's surprising. What were the spoofed user agents that they used?
We've run into this issue also, but all Facebook bot activity had user agents that contained the string "facebookexternalhit".