It's possible that this attack also works over IPv6, if the IPv6 firewall uses a similar ALG to open ports. It might even be easier, because there is no internal IP address to discover.