Thank you just for reading it! I've opened an issue on the project at https://github.com/billpg/CrossRequestTokenExchange/issues/6

If I may rewrite your scenario to check I understand it...

An attacker sets themselves up as an Initiator and registers https://evil.example/TimeOut/ as their URL to receive the TokenIssue POST requests. The attacker then makes a TokenCall request to which the Issuer responds by making the TokenIssue POST request to the malicious "time out" endpoint. As this never responds, that initial connection is kept open.