You are talking about ClickJacking attacks. (The title was different before my edit)
Can any one bypass it?
Is it neccessary to use X-FRAME-OPTIONS to prevent ClickJacking
For newer browsers it is the standard to prevent ClickJacking attacks. I do not see a reason not to use it, as it is quite simple to add the extra header for each response.
One of them told me that an attacker can redefine the location variable:
var location = 'foo';
As not all code is displayed, it's hard to say if this is exploitable or not. The only thing I can see from this one line of code is that the attacker could attack his own browser by modifying the variable location, which is useless.