I believe that you are asking if you can take advantage of traffic for targethost port 12345 being allowed in order to scan other ports on targethost aside from 12345.
The answer to that question is essentially "no".
Is the answer ever literally "yes"? Actually, yes.
Once upon a time, it was possible to fool some packet filters and weak-brained firewalls into passing traffic. If I recall, the method was to send a series of overlapping packet fragments. The packet filter (often a router) would look at the first fragment and say "Ah! Port 12345! I allow that, come on in!" and would pass subsequent packets without examination. But what if the second packet fragment had an offset that overlapped where the destination port was defined? The targethost, unlike the packet filter, is going to reassemble the packet before parsing it to determine what port it goes to. If the targethost resolved the overlapping fragments by overwriting the original fragment (the port 12345 fragment) with the subsequent fragment (say, listing port 137) and boom! Assuming the response packet can get out (again, something packet filters tend to do, modern stateful firewalls tend not to do) then it would be possible to scan arbitrary ports behind a firewall, piggybacking on a single permitted port.
Modern firewalls aren't that stupid, so it's generally not possible to do what you want to do today.
(It also used to be not-uncommon for packet filters to pass traffic by source port. Yeah. It makes handling things like DNS and FTP easier when you don't have an application-aware stateful firewall. It also allows anybody who wants to to connect right through your firewall, as long as they source their packets from (say) port 53 or port 20.)