Or some clearly visible icon at the end of the URL bar saying "2832 more characters ->".

Or make the whole bar red and flashing whenever someone uses the tricks this attack uses. Specifically data.text/html and inline script tags.