So then this would really be handy in a mud-slinging campaign. Maybe against a competitor. Any visitors would be treated to a massive drain on storage and other delights, but then the victim would still need to have multiple subdomains and/or wildcard subomains enabled.

Meh, just Goatse'ing them works pretty well too, no need to get fancy about it.