I haven't; there are definitely some protocol scanning differences. But off the top of my head, you could try 1) do a reverse lookup on a v4 address and then qu

I haven't; there are definitely some protocol scanning differences. But off the top of my head, you could try 1) do a reverse lookup on a v4 address and then query the name for a v6 address, 2) do DNS probing for a domain you're interested in, 3) try the v6-in-v4 mapping to find v6 addresses mapped to v4 addresses. If you could sit on a backbone and sniff DNS traffic or something, that'd be a nice sized cache of addresses.