Also, this "attack" only works on commercial style complex CDN setups. It wouldn't effect human hosted webservers at all.

All you need is a faulty caching proxy in front of your PHP server. Or maybe that nice anti-bot protection layer.

It really, really is easy to get bitten by this.