Yep, that's called a "negative dentry".
The DDoS scenario would be doing GET requests of random nonexistent filenames. You could change the name at every step so that the check for a negative dentry is never a cache hit.
Also the page/buffer cache would probably cache the FAT direntries so probably not a huge issue here.