But I'm not entirely convinced that most of these requests weren't just typos. Though those requests with mismatched Host header surely were true bitflips.

And I am beyond certain they were not typos; the requests were for long URLs that no one would be typing by hand. A few were for services that humans never enter urls into (like the Windows crash reporter).

I can't find it right now, but I also saw someone doing this with some version of Google Now (or what it was back then) and serving different assets into it.