There are actually several (published and non-published) ways to exploit that type of configuration, here is one example:

https://samy.pl/slipstream/

If you're talking about the general concept of using js to spoof another protocol: that exploit involves middleboxes sniffing TCP connections at the packet level, rather than at connection/stream level. It certainly won't work for connections with a TCP server.

If you're talking about using that exploit to allow access to the victim's machine from the internet: that won't work because listening interface for the x11 server is localhost, not the LAN interface.