If so, what are they and how do they work? (This is within the context of a blog. I do not have access to the server).
That is in theory possible. Privacy Badger monitors all the domains that are consulted when you fetch a webpage and then looks for third party domains (Domains that arent equal to the domain of the website you entered) that apear on many different sites asuming that these are trackers or ads. Of cause there must be a whitelist for google code and so on... but basicly that is how this plugin works.
When one creates a tracker that is divided over a huge load of domains and uses them in a round robin way it might be possible that it is not or just after a very long time detected and blocked by Privacy Bager. Indeed this can only work if they change their domains constantly because they otherwise could be blocked by simple blacklisting. Like I said its theoretically possible...
The simplest way of tracking someone with Privacy Badger being none the wiser would be by sharing some specific access logs.
When you request a resource from that site, you almost always will do so by sending a If-Modified-Since or If-None-Match token, and those can be tailored to allow reliable-enough identification just as if they were cookie tags. And they are requested together with a nifty Referrer header too.
At that point the "shared content" site is in a unique position to track you without resorting to cookies or anything else, which would supply one possible answer to the question "why do these people offer content hosting for free?"