Revised text in 3.5 as follows:

                                                    ... However,
   if the routing state is keyed only by (MRI, NSLP), there is a trivial
   denial of service attack (see Section 8.3) where a malicious off-path
   node asserts that it is the peer for a particular flow.  Such an
   attack would not redirect the traffic but would reroute the
   signalling.  Instead, the routing state is also segregated between
   different SIDs, which means that the attacking node can only disrupt
   a signalling session if it can guess the corresponding SID.

and in 8.3:

   SID segregation:  The routing state lookup for a given MRI and NSLPID
      MUST also take the SID into account.  A malicious node can only
      overwrite existing GIST routing state if it can guess the
      corresponding SID; it can insert state with random SID values, but
      generally this will not be used to route signalling messages for
      which state has already been legitimately established.

From Sam Hartman:

I don't understand the attack regarding off-path nodes inserting routing state
discussed briefly at the end of sections 3.5 and 8.3. Is the attack that you
could send a bogus query from off-path and get the upstream directed traffic
associated with a session?