I tried probably 50 different types of payloads there until I realized that the problem is actually with what appeared to be some sort of race condition with PhantomJS.
Fonte: escalating-xss- in-phantomjs-image-rendering-to-ssrflocal-file-letto Non riesco a capire il significato di "una sorta di condizione di razza" qui.