You actually can still do this type of attack using a POST it just isn't as simple as embedding an image, here's an example:

http://www.businessinfo.co.uk/labs/c...cks/holder.php