@scott,
Of course, IANASFE (I am not a salesforce employee) but it would seem to me, on the face of it, that the clickjacking protection would not allow a force.com page to iframe in a salesforce.com page.
Here's my reasoning and please, someone, shoot me down. Click-jacking is fundamentally a privilege-execution security issue where someone/thing with privilege is tricked into innocently taking an action that executes code with their privileges. Problem is, the X-Frames-Options header is a pretty crude brush to paint with. Last I looked, (few weeks ago) there were only three options: DENY, SAMEORIGIN and ALLOW-FROM. In theory, Allow-from is our golden goose. The catch is ... if your browser does not support this relatively new addition (here's the browser compatability breakdown: https://developer.mozilla.org/en-US/docs/HTTP/X-Frame-Options), the site is left without any active click-jack protection.
That means the safe, and secure default for IE < 8, all versions of Chrome, FF < 18, and all versions of Safari (including mobile) isn't ALLOW-FROM -- it's not supported -- but rather SAMEORIGIN.