Hidden <iframe> elements would probably work just as well. It might even work with JacaScript turned. Have a page with nested iframes. Serve each one from a di

Hidden <iframe> elements would probably work just as well. It might even work with JacaScript turned. Have a page with nested iframes. Serve each one from a different IP address and have the server not answer right away. The server answers with the first iframe having a chosen URL while Eve snoops the wire. Eve tells the server which URL to use for the next iframe body that it sends. Repeat until the cookie is deduced. The server can use a nested tree of iframes to avoid having a bazillion iframes in the top level document.