Snooping on tire pressure monitors has been demonstrated.[1][2] Range is about 10m with a simple antenna, 40m with a good directional one. Each tire sensor has a permanent 32-bit ID. Tire sensors only emit about once every 60-90 seconds (faster if the tire pressure is low), and only when the vehicle is moving (so the battery isn't drained while the car is parked.) Some can be triggered to transmit by an external LF signal, and this is done at vehicle start-up to get an initial tire check. That mechanism, though, is manufacturer-specific.
As a surveillance system, this has only modest potential. It would be useful to pair this with license plate readers, and notice cars whose license plate/tire ID relationships have changed.
It's probably more useful for taking inventory at car rental lots and finding abandoned/overtime cars in big parking lots. There might be commercial potential in this. Anybody with a big fleet could use something that checks their vehicles as they go in and out.
[1] http://www.winlab.rutgers.edu/~Gruteser/papers/xu_tpms10.pdf [2] http://elib.dlr.de/71397/1/VP_TS_NearctisTPMS_110607.pdf