So, I've managed to obtain private keys from a test copy of Apache on Linux - very unreliably but it works sometimes - and I can't actually seem to get it to work at all with a freshly-started Apache. As far as I can tell, there actually needs to be a certain amount of prior heap activity before the attack stands a chance of working. Whilst I haven't analyzed exactly what happens, this particular attack is intended to look for keys in the format OpenSSL uses to store them permanently in RAM.