When the victim views the attachment, the referrer bug strikes. Similar to CP, GoHip provides web based email solutions to third parties. They are definitely vulnerable to the referrer bug, but they are still in Beta. Also, the URL they leave behind in your referrer logs needs to be modified a little bit to make the exploit work. Although the referrer is protected by cookies if the link originates from within an email, the same is not true for email attachments.
Attachments provide a referrer that can be used, but only to view that attachment.
The caveat to all of this is that although the main account is protected by authentication cookies, the attachment can be used to execute arbitrary JavaScript commands - like commands that would grab the cookies needed to compromise the account. This one is fairly trivial to compromise. The referrer is wide open and no attempt is made to protect it. No attachments needed - send your HTML email and rest assured the victim will be compromised. If the payload is sent as an attachment, one can induce DotCool to execute JavaScript.