You probably know this, but the same is applicable to "cross-site request forgeries" in general, they just aren't as trivial to exploit as img src. If they can perform a GET they can perhaps use javascript to import confidential information into a loaded page and scrape that.

POST requests aren't safe from tricks by third-party sites either, as is mentioned here for example: http://www.owasp.org/index.php/Cross-Site_Request_Forgery

(Open Web Application Security Project looks interesting otherwise too.)