[simonw]

This is a really, really nasty attack. If you allow JSONP on your domain you are almost certainly vulnerable.