Have a look here, page 303. It seems that Atmel does not include a short circuit protection in its I/O pins, so a protection might be needed.
In the case of another MCU you might avoid using resistors, but that would depend on the MCU and on your luck. With a button you need a resistor indeed, so here is how to calculate it.
On the same table you see various parameters such \$V_{OH}\$ and \$V_{OL}\$. They are the minimum guaranteed voltages when output is high, and the maximum when output is low. I would assume conservatively full output swing, i.e. you are connecting \$V_{CC}\$ to ground. Assuming 40mA is the maximum current your chip is capable of delivering you get:
$$R_{min}=\frac{V_{CC}}{I_{max}}=125\Omega$$
for 5V and 40mA. Of course you can stick a bigger resistor and sleep safer nights, but why shouldn't you throw in some M\$\Omega\$s? That's because of speed. All pins have an input capacitance \$C_{in}\$, the time constant of the communication line is approximately \$R\cdot C_{in}\$ where R is the chosen protection resistor. If you need high speed communication you better keep that time costant as low as possible, you'd like something \$R\cdot C_{in}<\frac{1}{10\omega}\$ where \$\omega=2\pi f\$ and f is the frequency of the communication channel.
I'd go with \$1\text{k}\Omega\$ and play it safe.
