I can see a use of this type of attack for getting around captchas. If I host a web page that gives you access to download free mp3s, and all you have to do is complete a captcha to get it, what if I get that captcha from another site? I mean, when you load my page, I load the site I want to attack and show you their captcha instead?! That would basically make you my captcha-cracking conscript!