I wrote up a technique for storing values in the cache a little while back, no PNG or canvas necessary.
http://joshduck.com/blog/2010/01/29/abusing-the-cache-tracki...
http://joshduck.com/blog/2010/01/29/abusing-the-cache-tracki...
Cookie stored as a simple variable in a cached JS file is IMHO better solution if you're trying to be sneaky — there's nothing unusual in variable assignment or cacheable JS file.