If I have got this right in my head it would be a simple enough task to combine arp spoofing on a public WiFi to redirect clients to an evil SSL server which sends malformed heartbeat requests or to set up a honeypot WiFi and use the box as a router.. not many people would notice this as most public WiFi hotspots redirect you to a login page on connection.. my question is what information can be gained from the client side attack (other than their private keys which in this usage case wouldn't be that valuable as we already have ssl strip etc..)?