"no Javascript" is very misleading. There are several <script> tags embedded in each svg, including at least two scripts that are loaded from external sources.
In fact, nearly 1/3 of the data transferred for the first graph is javascript[0].
Curious about that too. If I load an svg in the address bar with embedded script I can show alert(), but linked into html using <img> tag, alert does not run. Sandboxed? Otherwise I could execute JS just by loading in using svg via <img>.
In fact, nearly 1/3 of the data transferred for the first graph is javascript[0].
https://gist.github.com/hughes/c876b02aa06f897c99e2