Old paper and fairly sure this vulnerability was already patched, but correct me if I'm wrong LiberLion

Doesn't affect hidden amounts or addresses either.

So this is what they would theoretically know:

Alice sent ? to ?

And it is also harder than you might think to sustain this kind of attack. ArticMine goes over the details in recent Monero Talk: