Again, untested:

        #! /bin/sh

        timeout=5
        fifo=/tmp/discover-vnc.fifo
        rm -f $fifo
        mkfifo $fifo

        dns-sd -B _rfb._tcp >$fifo &
        pid1=$!

        while read line; do
          case $line in *_rfb._tcp.*)
            # do something here.. then test
            # if flag=3 and break otherwise
          esac
        done <$fifo &
        pid2=$!

        sleep $timeout && kill $pid1 $pid2 &
        pid3=$!

        wait $pid2
        kill $pid3

Because it creates a file in /tmp? Who cares? The alternative is bash voodoo magic.. the same magic that gave us shellshock.