In some email I received from der Mouse, sie wrote:
[Charset iso-8859-1 unsupported, filtering to ASCII...]
> >> pass out quick on le0 to le1:ne.xt.h.op from 10.0.0.0/8 to any
> > hmmmm.... thanks for the hint!  I had thought that only worked for
> > "dup-to" (and that's the only place it's semi-documented :-)
> 
> dup-to, as described, does not do what I wanted.
> 
> The doc says "optionally with the destination IP address changed to
> that specified".  This sounds to me as though it rewrites ip_dst in the
> packet (which seems to me to be the Wrong Thing, even for dup-to).

Well you could, heaven forbid, try it and see if it does.

Darren