At DEFCON 17 (2009) Moxie Marlinspike gave a talk were he was able to use a malformed certificate signing request to get SSL certs signed for domains he doesn't own. The gist of it was that for the common name put something like www.bank.com\0.iownthisdomain.com
with \0
being a null byte.
Is this attack still generally possible, of course you can probably find CAs that are still vulnerable but are the clients, particularly Microsoft's SSL stack?