Just viewing this site as admin will remove comments with pk=3 and pk=4.
<img> attack - just viewing this image will load the site that deletes the 4th comment (since the protocol to get an image and view a site through HTTP is the same).
<iframe> attack using the same method as above