Popups are typically blocked by browsers unless they occur in an event handler which has been triggered by a user-initiated event like a click.
What you would probably want to do is open a popup to a local page which will trigger fetching the request token, redirect the popup to Twitter, and then grab the oauth_verifier when the user gets redirected back, then close itself. The javascript code would look something like the following if you didn’t care about IE7 or lower:
var a = document.getElementById("#anchor-id");
a.addEventListener("click", function (evt) { window.open(...); }, false);
