If this is the only manner that the FBI --or any law enforcement for that matter-- has for identifying TOR users, then wouldn't the best operational security just be to firewall yourself off completely except for Tor connections? Better yet, you could monitor what applications are trying to broadcast out even if they are designed or intended not to leak. Isn't this what the TAILS live-CD does? For this case, even if your software was out of date and vulnerable to the initial attack on the browser, the attempt to broadcast out would hit a firewall and fail (and ideally be logged and alerted).