The context for this question (it's quite involved) can be found in this document: https://docs.google.com/file/d/0B15itpMWb2ztWTJrYTgzX204OVU
However, I want to make it clear that you don't have to read or understand all of that document to answer this question.
Basically, this technique allows the audit of a TLS 1.0/1.1 session without revealing sensitive data (one can effectively choose which html or similar to reveal as part of the audit). However, it's necessary, during the loading of that single resource, that the client does not have possession of the server mac secret (they still have exclusive control of all other secrets - encryption keys and IVs). What potential attacks does that enable?
We should consider an external attacker as well as the 'auditor' (the one holding the server mac key).