Given that RC4 is a stream cipher (I'm pretty sure the details of its inner workings don't matter for the sake of this argument) and the existence of Mixed Scripting / Mixed Display (web applications requesting and retrieving contents both over unencrypted and encrypted channels). Does the combination of a stream cipher encrypted SSL session and a mixed scripting / mixed display vulnerability not constitute grounds for an XOR attack?
I understand that if content is requested unencrypted we essentially have the plaintext, but what would one not be able to retrieve the SSL sessions symmetric encryption key using such an XOR attack? i.e. [encrypted request] XOR [unencrypted request] = some key bits?