This bug has actually been fixed, minutes after it was reported on MSE:
Thanks for reporting! A fix for this was just deployed, and the CORS headers are getting sent again.
A more detailed explanation is available on an answer to the same bug report on MSO.
The snippet provided by Brock Adams correctly fetches all 300 pages without gettting any CORS errors.