I wonder if anything is using URL.equals to check for 'safe' urls. Some creative use of DNS TTL could probably make things interesting.
if (internalURLs.contains(submittedURL)) {
check. Then change your DNS records to point to some other server, once your domain is in their database and they assume it to have already been validated as internal.