[iCarrot]

What you just described is actually a web beacon [1], in which case the one that embed the URL is the user (and not the one who load the <img>). Web beacon can be used to implement useful thing like visitor counter service [2].

[1]: https://en.wikipedia.org/wiki/Web_beacon

[2]: https://www.hitwebcounter.com/

[oefrha]

It's also "useful" for cross-site request forgery.

[iCarrot]

Cross-site request forgery is only "useful" in auth context. There is no auth in Volatile, nor in the hit counter.