Tl;dr: By placing load on suspected hidden service hosts (over normal, non-anonymous IP), one can then measure the change in clock skew (as a result of higher CPU / chassis temperature from the higher load) over the anonymous channel to confirm it is the same host (by comparison with clock skew before load).

The result holds over many hops and onion layers (this is the usual "the average of random noise is zero" thing). Very cool.