Yes. I chose to demonstrate it using an XSS vulnerability because it makes for a much easier to understand PoC (you click on a link and see an alert box). ;)

Had the XSS vulnerabilities failed, I would have spent more time investigating the cache poisoning possibilities.