Here are the steps to reproduce on a Winter 13 sandbox:
Create the following VisualForce component called TestClickJackComponent:
<apex:component > <!-- Begin Default Content REMOVE THIS --> <h1>Congratulations</h1> This is your new Component <!-- End Default Content REMOVE THIS --> </apex:component>
Create the following VisualForce page called TestClickJack:
<apex:page StandardController="Lead"> <!-- Begin Default Content REMOVE THIS --> <h1>Congratulations</h1> This is your new Page <!-- End Default Content REMOVE THIS --> <c:TestClickJackComponent /> </apex:page>
Add the page to your lead page layout. You'll see:
Congratulations This is your new Page Congratulations This is your new Component
Now go to Enable Setup-Security Controls – Session Settings and select Enable clickjack protection for non-setup customer Visualforce pages
Now you'll see:
URL No Longer Exists You have attempted to reach a URL that no longer exists on salesforce.com.
So, my question is - is this a bug? Or is it expected behavior with the new clickjacking protection?