It can't actually be used to exploit SPV clients at all, since having even a single destination address puts the transaction over 64 bytes in size.