Mal can now check his server log and hijack Vic's session, since the malicious redirect passed his session ID in the URL.
output.log