Why address poisoning works without stealing private keys

{# Share Buttons Partial Variables: share_title — text to pre-fill in share dialogs share_url — canonical URL to share (use request.build_absolute_uri in parent) #}