Michal Zalewski put together a really amusing asteroids proof of concept to demonstrate how a modified version of the javascript ":visited" attack can be leveraged based on visibility. Proof of concept js included.
0c1b7330caf6f1622bcdfe153cd13fde591641b80ff7a9881a550469301c5a39