Securethoughts has posted an entry on combining CSS history theft hacking to brute force short CSRF tokens and has created a POC demonstrating it. While not fast this is certainly achievable (assuming the token is still valid/hasn't expired once identified) on short CSRF token values, and has the advantage in that it doesn't perform site requests which doesn't risk invalidating the user's session on invalidly guessed tokens. Yet another use for CSS history theft.

Read more: http://securethoughts.com/2009/07/hacking-csrf-tokens-using-css-history-hack/