Sadly, their identities were likely revealed by confiscation/duplication of the SR server data not through javascript exploits of TOR.
Also Ulbricht, if he even is DPR, was caught by dropping the ball once for one minute. Why such a guy would make ANY accounts in his own name is beyond me and IMO casts doubt on that as an explanation for catching him.
