[colinmarc]

I don't see how this attack would work on SPDY, unless you could add arbitrary headers to the request. CRIME works because the entire request is compressed together, whereas in SPDY the header block is compressed separately.

[yuliyp]

The URL can be attacker-controlled