This should be impossible because of the layered encryption, but some documentation suggests that this can somehow be done.
From Section 5.6  of tor's specification
When speaking v2 of the link protocol or later, clients MUST only send
EXTEND cells inside RELAY_EARLY cells. Clients SHOULD send the first ~8
RELAY cells that are not targeted at the first hop of any circuit as
RELAY_EARLY cells too, in order to partially conceal the circuit length.
RELAY_EARLY cells were introduced to prevent arbitrary-length circuits to be established, as described in proposal 110 .
But even that one does not provide a reliable answer.
So why 'partially conceal'? How could a middle-node of a circuit gain information about circuit's length? Is there any more research about this available somewhere?