It’s about parallel pipelines isn’t it? The crack is to take over a speculative execution. I’d imagine the timers are used to delay execution and hijack the other pipe, which flows out of the sandbox.
A couple of hours ago I was reading about Clojure’s concurrency mechanisms. It demonstrated why functions mustn’t have side-effects, by demonstrating how the unknown execution order might cause code to be re-started when there are collisions, so state change statements may be repeated. It’s not hard to imagine that might be exploitable.