Read the section entitled "Packet sniffing by other tenants" - the hypervisor won't permit you to put an interface into promiscuous mode.
Do we know the details of Heroku's LXC configurations for dynos on their Amazon Domu instances?
http://devcenter.heroku.com/articles/dyno-isolation
"On the Heroku dyno manifold, each and every process has full isolation from all other processes, including those of the underlying operating system and other processes from the same application. This provides complete protection from either of the circumstances above, and many others."
Based on that, do we presume they are also using routes and not bridges?