Browser fingerprinting is the only way I can think of, and between the phasing out of flash, java and silverlight, and having javascript disabled by default, browser fingerprinting is pretty much toothless.
I go on site abc.com, which gives me the cookie abc:111 Then I go on xyz.com which gives me the cookie xyz:222
Because of the same origin policy, xyz.com can't access the cookies set by abc.com. Abc and xyz can communicate as much as they want on the server side, they will not be able to tell that abc:111 and xyz:222 are the same user (absent additional information: browser fingerprinting, email address if you have an account on both, etc).
So you visit abc.com for the first time, get an ad image served from the same domain (but was provided from the ad network), have the cookie set, the ID is noted by the ad network.
You then visit xyz.com, a new cookie is generated, which can be tracked by the ad network as the ID is the same.
So you now get tailored/tracking adverts without any third party domains being accessed by your browser...
Well, that is effectively using abc as a tracking server, and abc.com would quickly be added to the adblockers lists. Effectively this is the current model.
The other thing is that I may visit abc.com and xyz.com but this particular combination may be unique to me, i.e. I may visit nytime.com and ford.com which may use the same ad network, but you may not visit nytime.com at all and instead wsj.com.
Browser fingerprinting is a different problem. It does defeat the same origin policy. But I suggest you look at the sources of entropy: https://panopticlick.eff.org/ With javascript off, there is virtually no entropy, just your user agent and HTTP_ACCEPT header. You can't fingerprint a browser at all.
If you enable javascript but not plugins, then the Browser Pluggin details give you some entropy, although looking at the list those a relatively generic and would likely be the same on many machines.
If you enable plugins (flash, silverlight, java) then you have a massive amount of entropy but realistically all of these plugins are almost gone from major browsers.
The ad cookie/ID is then sent from the abc.com server to the ad network (along with whatever data they need to determine what ads were seen/clicked), who collate all the data from wherever their js file is running, thusly allowing them to track you, without any requests from your browser being sent to any other domains other than the ones you directly visit.
You're assuming the server-side scripts won't share data with a central server.