I read last week about this. Don't know for sure but the article said that some javascript or browser addon, if tor is misconfigured or in default, this scripts could run outside the tor network, leaking the real IP.
This can be a way I think.
I'll try to find this article to complement
EDIT: Didn't find the article but find that this happens because a thing called "WebRTC". Maybe has already been patched.