It's different when the customer knows about the timer and agrees to it somewhere in the EULA. It's when you hide that security file, or go back in and do something, that you're stepping into a whole new pile of shit.

A lot of PHP software (forum software like vBulletin, CMS's, etc.) have phone-home or license verification mechanisms. That's usually fine, unless you whip up something nasty that does something beyond just disabling the software in question.