It's a novel exploit of deduplication, but I don't see how it's practically any better than moving a file into the /Public directory and handing them a URL.
That has significant benefit over shared files and I have to think would scare the heck out of dropbox because of the ire it might bring upon them. This would have to be a worst nightmare for them. Although removing deduplication would solve it for them (with significant increase in what has to be stored).
1) User buys a file from the rights owner and explorers it into his Dropbox
2) User obtains a blockwise hash of the file and runs dropship on it
3) User obtains a public URL from somebody who has the file and downloads the file from the Dropbox web server
The point is that the Dropbox server cannot distinguish 1 from 2, but both from 3. Therefore, 2 should be more robust against takedown notices than 3.