The browser could give the user a unique popup style (colored borders, etc.). As long as that info is hidden, this attack would have only a tiny chance of succeeding.