I recently had an internal penetration test with a client.  During the initial discussions, where the client set the scope and so on, I asked if they had any IPv6 in their environment (mainly because I'm hoping that someday, someone will say yes).  Their answer was an emphatic “no”.  My answer to that was “Challenge Accepted?”, and they ruled IPv6 in scope with a “knock yourself out, there's nothing there”.