They'd probably run a suite of microbenchmarks in the sandbox and use that performance profile to fingerprint you. That might be an improvement over the status quo, but I think the basic rule is that if you let tracking scripts phone home, you lose.