Scripts and styles should be queued using a function that can check whether to load static resources as http or https.
Currently, the plugin uses constants like these:
$wp_content_url .= '/wp-content';
$wp_content_dir = ABSPATH . 'wp-content';
$wp_plugin_url = $wp_content_url . '/plugins';
$wp_plugin_dir = $wp_content_dir . '/plugins';
define( 'FBFW_PATH', $wp_plugin_dir . '/fancybox-for-wordpress' );
define( 'FBFW_URL', $wp_plugin_url . '/fancybox-for-wordpress' );
Instead, it'd be more helpful to simply use plugins_url which respects the protocol. This is an issue if you're using https because the browser displays warnings of insecure content.
Here's some code you can use in a plugin or theme to deregister all scripts/styles and re-register them using the correct protocol: http://pastebin.com/ur8DSN4s