Each side does one scalar multiplication
"Derive shared secret" runs one elliptic-curve scalar multiplication per side, using the same double-and-add computation covered in the ECC module: Alice multiplies Bob's public point by her own private scalar; Bob multiplies Alice's public point by his.
That's the entire exchange — only the public keys shown above ever cross the wire. Everything after this point happens independently on each side.
Landing on the same point, from different directions
Scalar multiplication on an elliptic curve group is associative and commutative in exactly the way that matters here: a·(bG) and b·(aG) are both equal to (ab)G. Neither side ever computes or transmits ab directly — each only ever touches their own private scalar and the other side's public point.
From a curve point to 256 raw bits
The value handed back by deriveBits() isn't hashed or processed further — the Web Crypto spec defines it as the raw x-coordinate of that shared point, encoded as a fixed-length big-endian byte string. That's exactly the hex value labeled "Secret" in this tool.
Raw curve coordinates like this aren't perfectly uniformly distributed as random bits — some x-coordinates are reachable from more private keys than others — so real protocols always run this value through a proper key derivation function (HKDF, covered in the key derivation module) before using it as an encryption key. This tool shows the raw value specifically so you can see what ECDH actually outputs, before that extra step most applications add on top.
Why Mallory's attempt lands somewhere else entirely
Mallory has her own, completely unrelated private scalar m. Multiplying it by Alice's public point gives m·(aG) — a real, valid point on the curve, but with no algebraic relationship to Bob's private key b. There's no shortcut from "any point on the curve" back to "the specific point only someone holding Bob's exact private key could reach" — that shortcut not existing is the elliptic curve discrete logarithm problem itself, the same hard problem the ECC module is built around.