I see several problems with this method. 1. You need to run an exit node for unencrypted HTTP traffic to be able to inject html. 2. Tor warns you when you are

I see several problems with this method. 1. You need to run an exit node for unencrypted HTTP traffic to be able to inject html. 2. Tor warns you when you are potentially leaking DNS requests when you are using an old protocol like socks4 instead of sock4a. Anyone who is using Tor is presumably smart enough to activate this option on Firefox or whatever browser they happen to use, 3. The Java applet leaking DNS requests is a big hole which I believe is fixed by now. Even if it did work, it is entirely dependent on point 2 which is easily preventable.