Facebook embeds videos in the News Feed and Timeline by using previous knowledge of the way each site supports embedding videos. That means Facebook tries to "understand" the page to which you're linking, and then attempts to embed it; the user doesn't actually control how the embedding happens, ie. when you see an embedded video on Facebook, you can be sure it's embedded in the way Facebook intends it to be embedded.
The key here is know to where the link is leading: Notice in the domain name in this Facebook post
That field cannot be manipulated by the poster without actually changing the domain to which the link is leading. So unless you're being MiTMed, when you see a video embedded that way in Facebook, and you see
www.youtube.com as the target domain, then you can be relatively sure that clicking the thumbnail will load the genuine content from YouTube. Same goes for other video providers (Vimeo, DailyMotion, etc.)
However, beware of the rouge Facebook apps that are able to embed videos and trick you into installing malware after you click on the thumbnail. You'll notice that app-embedded videos don't have that domain field.
In any case, app or not, video or not, always be cautious whenever you click on anything
Update: I've just noticed a different Facebook behaviour which is also legitimate and it doesn't involve the domain field mentioned earlier.
Sometimes when the video is shared from within YouTube to your Facebook account, the domain field will not appear in the post, but it will explicitly say "Via YouTube". So also watch for this, it can also be "Via DailyMotion", or "Via Vimeo", etc.