While interesting, this attack is old. A newer "variation" on this is with HTTP POST instead of headers.

http://www.darkreading.com/vulnerability-management/16790102... http://www.owasp.org/images/4/43/Layer_7_DDOS.pdf