The same-origin policy is a client-enforced restriction. Certainly, it's possible for a particular client to fail to enforce this restriction. Note that doing so would bring the client out of compliance with W3C standards for the XMLHttpRequest API and iframe behavior.
Note that any program that can formulate an HTTP request can send a request to your site. The danger in violating the same-origin policy is to users, not to your site. Ajax requests send authentication cookies, so if a foreign site could, e.g., fetch the contents of
mail.google.com while your browser is logged into Gmail, that foreign site could read your mail. The risk is not that a cross-origin request could reach your site, but that a response from your site could be read by a cross-origin site.
For example, anyone can launch an attack against a site with netcat by repeatedly doing something like:
echo "GET /index.html HTTP/1.0" | nc example.com 80
thereby flooding the site with TCP requests that each contain an HTTP request. It's easy (easier, in fact) to do the same with any dedicated tool for sending HTTP requests like cURL or wget.
If I've misunderstood your question, and you really are concerned for the user: Wikipedia makes the unsourced claim that Netscape Navigator 2.0 (released 18 years ago) supported the SOP, and this help forum post asks about how to circumvent the SOP in IE4 (released 16 years ago), so we can be certain that SOP enforcement has been around quite a while; any browser old enough to omit SOP enforcement probably has many other major holes in it, and you probably shouldn't expend too much effort trying to protect users who use a decades-old browser.