How long before all these CSS tricks come together to make a easily abusable injection mechanism? I know the `url()` mechanism is already abusable, but what abo

How long before all these CSS tricks come together to make a easily abusable injection mechanism? I know the `url()` mechanism is already abusable, but what about a small VM executed via `var` and `calc`?