The authors of this vulnerability analysis get it - eviltoast