Let me explain with a nifty diagram:
IP/RP <-> bunch of Tor clients/node (Tor circuit) <-> Tor hidden service
Wouldn't the last Tor client in the circuit knows that the message is for the Tor hidden service? I know that the communication is encrypted, but there is an IP address associated with each packed (i.e. send this encrypted packet to A). If the last node to the hidden service knows the IP address to send the packet to, wouldn't it know the hidden service's clearnet address?
I have read the specifications for Tor hidden services, IPs and RPs, but it just seems to not explain its immunity to exit node sniffing.