Basically your mobile phone company is adding your phone number to HTTP headers when you visit certain sites.
So when you visit www.advertiser.com your request goes to your mobile phone operator, via cell towers, through their network, off to the internet
Obviously the cell tower knows your number, as does your phone operator, they configure their router to add some more headers to your HTTP request (unencrypted) because the owner of advertiser.com pays them to do so.
This extra data is then sent over the internet to www.advertiser.com who can simply parse it out of the headers and put it back in the
<input> tag in the response.
facebook are being quite open about this here. But they will also get the phone number, along with the website url of every site you visit with a like button somewhere on it. Which they then store on a big database in china