Apparently nobody has applied for .localhost yet.
"Despite not being a valid top-level domain in the Internet, considerable DNS traffic that queries the local domain exists in the public Domain Name System.[1] In June 2009, the L root server received more than 400 such queries per second,[2] ranking 4th in DNS traffic of all TLDs after COM, ARPA, and NET." [1]
Scary potential for mischief-making. Hopefully ICANN would reject applications for these domains, but I'm not sure I'd take that level of competence for granted.