I think the biggest problem with this attack is that many don't believe it to be possible. And why should they, given the inconsistent browser behavior.