This is because Facebook loses all of the authentication variables and is unable to determine that the concurrent requests belong to the same session, which results in "breaking out" of the iframe and ending up on your own server pages instead of within Facebook.
Anytime a page is served through Facebook, the request received at your server will include a number of GET variables sent by Facebook, these variables are collectively known as the "Facebook Authentication Signature" which proves to your server that the request actually is valid and originated from Facebook; likewise, when your server sends the response, the inclusion of these variables proves to Facebook (by a combination of the session_key, api_key, and sig digest) that your server is the application it claims to be.
In order to persist the session within your iframe app without breaking out to your server, you must include these parameters on each link's query string. Here is a simple function that will produce the query string for you, so you simply need to append the result of this function to each link URL in your application:
function fb_sig_urlQueryString() {
$query = '';
foreach ($_GET as $k => $v) {
if (strpos($k, 'fb_sig') === 0) {
if ($i++ > 1) $query .= '&';
$query .= $k.'='.$v;
}
}
}