Saw this at Shmoocon last year (Score 1)

http://www.shmoocon.org/2007/presentations.html
Scroll down to Sunday - March 25th, 10:00 am presentation
Joel Bruno and Eric Smith
VOIP, Vonage, and Why I Hate Asterisk

You can download video of their presentation.
Basically, intercepting RTP (voice traffic) is as trivial as any other traffic.
The question is, does the equipment respond to unsolicited ARP replies?