In the wake of the POODLE attack, many web sites have dropped support for SSLv3. But some clients still in relatively common use as of May 2015 still initiate the handshake with an SSLv2 ClientHello message. For example, openssl 0.9.8 which ships with Mac OS X 10.10, and Java 6 which is also still in common use at least on Mac OS X.
Oracle recommends that servers using the JSSE to terminate SSL keep the SSLv2Hello pseudo-protocol enabled, which in turn allows an SSLv2 ClientHello handshake, for backward compatibility with such clients. (See table rows "Developers using JSSE APIs - Server").
Although clients using SSLv2 ClientHello are vulnerable to protocol downgrade attacks, this is also true of clients using later handshake versions as well, unless both the client and the server support TLS_FALLBACK_SCSV. And as long as the server has disabled SSLv2 and SSLv3, the handshake cannot complete with a protocol lower than TLSv1. And I suspect clients which support TLSv1.1 or later probably do not use SSLv2 ClientHello anyway, so this seems to me to be a reasonable configuration.
Are there any known attack vectors I have missed which would make it inadvisable to keep SSLv2 ClientHello support enabled?