This attack was used successfully against gmail in Jan 2006.

http://jeremiahgrossman.blogspot.com/2006/01/advanced-web-at...