Sites that use Facebook logins should never have access to your username/password. The Facebook API connects the user directly to Facebook, authenticates the user, and then passes that authentication back to the website that you're on.
If something different is going on, that website is probably behaving maliciously (think, emulating the facebook login process like a phishing site, in which case your facebook login would already be compromised). In this case, there's a fairly narrow attack surface opened up by HeartBleed... if that site's private key is compromised, and the session where you sent your user/pass to them was previously captured by the attacker, then they would be able to decrypt your communication. I'm gonna put odds on this one as pretty low. Otherwise, if they are unpatched and you send your facebook user/pass to them again, then an attacker could grab it if they are attacking reasonably close to that moment.
I'm not gonna suggest that such a scenario doesn't exist anywhere on the web, but any site that you typically would want to access that uses a Facebook login never had access to your user/pass to begin with, because the API specifically protects against that scenario.