A couple minutes ago Phantomcircuit directed me to
this writeup...
That has two weaknesses:
1. All transactions must be the same amount.
2. The participants have to be trusted to produce uniformly distributed keys. I think this means it isn't secure?