<feImage> does not support SVG fragment urls This should be only a couple hours work. I'm surprised we didn't do it before. All that needs to be done is for some flag to be set on the FEImage rendering object, such that it knows to check element()->href() and look up the associated element and tell it to draw (similar to how masks work). Alternatively we could copy the href() string from the FEImageElement to the renderer instead of calling element()->href() either way works.
Based on the ImageBuffer renderSubTree support, this should be totally possible. This is probably just a couple hours work at most.
Fix landed in r52865. closing the bug now.