quick proof of concept of the leak idea
though nprofile1qy2hwumn8ghj7un9d3shjtnyd968gmewwp6kyqpqat960hkp608a57xfduduhmdfn37f8s68xkcp72kwyngt6488fhwqnvp5pl (nprofile…p5pl) reminded me of their version of essentially the same thing (albeit with a bit different of an implementation): https://blog.pspaul.de/posts/bench-press-leaking-text-nodes-with-css/