So say I've stored Facebook cookies, so that I don't have to login every time I visit Facebook. Would a CSRF attack on Facebook work(assuming they don't have CSRF protection), if I don't currently have a browser tab open logged into Facebook?
Though there are some details that impact this, going by the general principles, the answer is YES.
An attack exploiting CSRF would attempt to execute some function of the target site (facebook, in your example) in the browser context.
So the key test is: If you open facebook in a tab (in the scenario you mentioned), would it give you a logged-in session directly. It appears that it would. In that case, it meets the conditions necessary to mount a CSRF attack.
There are many nuances. For example: Vulnerability != Exploit. i.e., though the attacker may get CSRF to work (and produce a POC to get a bug bounty or complete a VA/PT assignment) - there may be nothing there to exploit due to other protections. e.g., if additional auth is required to really do any damage.