Comment by JoshTriplett

Browsers allow entering fullscreen as long as it's in response to user input, such as clicking a button. When entering fullscreen, browsers emit a prompt about exiting fullscreen, partly to make sure people know how to exit and partly to make sure entering fullscreen doesn't go unnoticed. So, it'd be hard to pull off such an attack.