Presumably not on a post-iPad2/iPhone4S, or without access to a previously-paired computer, right?

A normal user could do it on any device with the A4 chip or prior, vulnerable to the limera1n exploit. Apple could do it with any device, as they own the signing keys for the bootloader.

There's even pre-built forensic ramdisks if you'd like to have a play around — https://code.google.com/p/iphone-dataprotection/

I'm willing to bet that there's at least one private bootrom exploit, one of the jailbreak developers has hinted that he has found one.