If you were hit with this attack, would you see a pdf attempt to load in the browser? Was it a hidden iframe? Were any popular tube sites affected (PH-network, etc)?
1.) Displaying a message that the PDF may not be displayed correctly, which looked like this: https://support.cdn.mozilla.net/media/uploads/images/2013-03... except for the PDF of course, because it was loaded in a hidden iframe.
2.) In my case the exploit tried to open one of my public keys (with the .pub file extension) but because the browser determined this was an executable file (because of the mime-type) that should not be displayed by the browser it triggered a file dialog asking me to open the file with some other program. This is what alarmed me and that way I discovered this 0-day. I must say however that other versions of the exploit have surfaced that do no longer target the public key file (maybe for this reason?) so the file theft may not be noticed.