Ping/IP conflict?

Well  that esentially means you can scan through a firewall with that technique.
Only disadvantage is the person being scanned would be notified of the conflict, which is lousy for stealth but you could probably use it for a DOS attack if you wanted, although WinArpAttacker would be the best way.
You would probably have to use semi loose source trace routing though to get it to work through the net, or WinArpAttacker has an ipforward function.