Nobody said it was a Tor exploit. It's just a deanonymization technique, which like most, rely on social engineering (convincing the user to push a "Save File" button).