As far as I can tell, this use case is not allowed because of cross site references related security concerns. The form can refer to the images stored on the same server from where the PDF is served, but the images cannot come from external servers.