In the example given, there's no arbitrary header. "HELP" is part of the POST data, which is controlled by the application. And example attacks 2 and 3 do not

In the example given, there's no arbitrary header. "HELP" is part of the POST data, which is controlled by the application. And example attacks 2 and 3 do not require seeing the response, only executing it, which you're permitted to do via a <script> tag.