With regards to the second point, definitely.

Quite a few years ago the security team of the organisation I worked at didn't have our internal vulnerability scanning services automated. It relied on them capturing the IPv4 addresses (specifically the /32's, not the subnets) and manually entering them into the engine.

Our security team mistyped a handful of these addresses and instead of the scan running across our internal infrastructure, we scanned WalMarts external facing infrastructure in the US from Australia.

These scans were happening semi-regularly for a period of a few weeks before we received a cease and desist and the sec. team realised their error. I'm still rather surprised more didn't come of it.

No, I haven't heard of anyone being criminally charged for ping, but I have known someone whose ISP cut them off and he had to go through an onerous process to get service restored. I've also heard of people that use EC2 instances and get their AWS account terminated.

Adding to sibling comments, some networks are extremely heavy-handed at self-regulating host discovery. Back when I was on AS88, I once got a warning alleging that I was performing suspicious port scans. I acquired a report of my “suspicious” activities from the admin, and turns out all I did was connecting to port 22 of some two dozen hosts I rented from a handful of VPS providers across North America and Europe. Of course the warning was dropped after my explanation, but I found it pretty crazy.