You should never, ever allow an iframe on a public form, that just asks for attacks!
Youtube should be handled via their own plugins. It has such button, but it not get parsed on the frontend. I just posted the plugin, Mark made it, so i am not sure what he intended to do here, maybe that...