Again, if you embed non-SSL content into a SSL website, you are obviously doing something wrong.

Regex in CSS can be used to guess page content. Also CSS can load SVG which may include JavaScript.