If LOAD_DO_NOT_SEND_COOKIES or LOAD_DO_NOT_SAVE_COOKIES is set on a URLRequestHttpJob, the request will go to the privacy mode socket pool.  If LOAD_DO_NOT_SEND_AUTH_DATA is *not* set on the socket, some forms of ambient identity may be used on the privacy mode connection.  I believe this can poison the privacy mode socket pool with sockets that have used client authentication.

It's my understanding that this does in fact happen on some web-initiated requests in practice, though I'm not quite sure which ones.