There's a CSS and an image:
Then there's an async JS (asyncjs1.php) created by using an iframe and delayed 5 seconds. Also hosted on a different domain to test x-domain restrictions
asyncjs1.php
I wonder what is going to happen...