Of course, the attacker could fetch the descriptors of the popular hidden services and see if he connects to himself. In that case it would be provable. I love discussions like this. They really get you thinking.