The vulnerability of ADS-B, as I understand it, is the ability to mimic that there is a collision with another aircraft, since it is trivial, as far as I can tell, to send a message impersonating another aircraft. There is no cryptography of authentication whatsoever in ADS-B, you just write the aircraft ICAO address into a field.
So if I simulate aircrafts in collision route, I think the system will tell the pilot to climb or the reverse, depending on the condition. Maybe this can be used to create troubles...