Cryptographically strong seeded pseudo random number generator Why is the following not cryptographically secure?

Seed the algorithm with 32 random bytes S[0].

S[0] --hash--&gt; S[1] --hash--&gt; S[2] --hash--&gt; S[3] ...
 |              |              |              |
hash           hash           hash           hash
 |              |              |              |
 v              v              v              v
R[0]           R[1]           R[2]           R[3]


The hash function is cryptographically strong, i.e. it cannot be reversed.

The outputs (R) comes in 32 byte blocks, R[0] onwards.

Obviously this is far too simple to be secure, but I wondered why.
In your scheme, $R[0] = S[1]$, because hashing $S[0]$ always gives the same result.

So knowing the output $R[0]$, the attacker can predict the entire stream - he knows the complete internal state at the position of $S[1]$.