Following some of the comments on this question, I was curious about the security vulnerabilities of NAT. There are similar threads here and here but they discuss router vulnerabilities rather than NAT vulnerabilities directly.
So imagine I have a router directly connected to the internet, the router has no configuration not explicitly required for the operation of NAT. The router also has no direct vulnerabilities in the ports it might expose (i.e. it has a well engineered HTTP interface with a strong password policy / lockout). There is also no port forwarding enabled on the router. Obviously it also has no Wireless networking attached etc.
The only attacks that are possible are directly across the internet, and no traffic from behind the NAT device will visit a site controlled by you.
In this configuration is there any way for an attacker to connect to a machine on the other side of the router.
I realise that this is a highly theoretical question that security is never about attacking a single thing. Attacks are always about finding the weakest link in a system. However, without those theoretical questions we'd know the vulnerabilities we need to protect against.
(If I'm entirely honest though, this question is as much about saying 'prove it' to those who say that NAT provides no security at all)
As an extension to the above question, which of the rules above would need to be removed or adjusted to create a realistic attack vector.