Events can be set to trap when the image has finished loading and what the size of the image is. This creates a side channel for JavaScript to communicate with certain 3rd party hosts using the dimensions of the image. In practice, XBM images tend to work best because you can specify arbitrary lengths and widths up to a 15bit integer without actually needing an image of that size.

I knew I had talked about this publicly before! This was from Jan of 2007.

Good to know I'm not going crazy :-)

More image side channels