How does the attacker include input before compression and encryption in CRIME?
Malicious JavaScript could trigger calls against any SSL server. Although this JavaScript is not able to actually read the cookie for that server directly, the browser will send that cookie through the SSL tunnel.

The JavaScript will then alter the URL, keeping the server but changing the path or request parameters. In that way it can inject data before compression and try to identify parts of the cookie.