This question is not about the trivial usage of the forward/reverse DNS.
Getting the IP of a hostname is trivial (DNS), and using reverse DNS, also we can get (typically) a single hostname of an IP.
However, particularly for massive http virtualhosting, there is a (sometimes quite long) list of the hostnames, what resolves to a given IP. This list is not given back by the reverse DNS records (although it would be possible, it is not the practice).
If a possible attacker has access to this list, he can have much more broad attack options, simply because he knows all the virtualhosts on which the target can be accessed.
This database could be collected by large-scale data collection and processing, ideally by using public search engines, or by developing a specified crawler for this task.
Does it exist already?