The challenge would not be the Same Origin Policy, it would be finding out what IP address your router has. Browsers don't give that to Javascript (which is probably good).

However, you'd be 99% successful trying the most common IPs first:

  192.168.0.1
  192.168.1.1
  10.0.0.1
  10.0.1.1
  etc.

Then the attacker just sets up a scripted DNS server under their domain, like this:

  192.168.0.1.ip.example.com A 192.168.0.1
  192.168.1.1.ip.example.com A 192.168.1.1
  10.0.0.1.ip.example.com    A 10.0.0.1
  10.0.1.1.ip.example.com    A 10.0.1.1
  etc.

As you can see, Same Origin Policy wouldn't prevent javascript from sending a POST request to a subdomain, and the attacker controls their DNS so getting an IP address isn't hard. (The DNS server uses a script instead of actually having all the IP addresses spelled out in a config file.)