There's at least one video online [1] that talks about Netflix's process for internal FreeBSD releases. They do 5 weeks of development and then 5 weeks of testing.

[1] https://www.youtube.com/watch?v=vcyQBup-Gto (about the 12 minute mark)

In this particular (Netflix) case, what's the worst that could happen? One of their OCAs panics and falls over... and all customer traffic gets shifted to another OCA in the same or another location?

Sure, they might run into some bug in -CURRENT, but what's the chance of a bunch of their OCAs all hitting it at the same time?

I've been running CURRENT in production myself for about 2 years now. No problems so far.

If you have kernel developers on your staff: yes

Yes.