Since a client won't know how to dereference this URL, they will not come in contact with this problem. No reference version is available today. However, the more general nature of S-HTTP make it difficult to assess exactly what is possible. In the case of a hacker, or looker, the attack on a CA may be more difficult, due to the existence of multiple CAs. A key could theoretically be verified by several CAs, making an attack infeasible.
Insiders have similar options, but an expanded ability to wreak havoc within an HTML document.
In The Middle, and replay attacks. It is more robust than SSL, because option renegotiation and retries are permitted. In addition, the cost of clear text cryptanalysis of DES is substantially higher than that of RC4-40. A 56 bit DES key costs one million dollars to break in 7 hours. This cost scales up and down in a linear fashion.