I am pretty sure there is a same site origin policy in place (for both replaceState and pushState), you can't spam history with sites except the one you are on.
Ok, but how is this any different than the "poisoning" of URL history with visiting thousands of web pages with different titles?
Interesting that you (two or three) assume everybody's fine with your brand of 'spamming' (your words) the more or less useful, more or less used info in someone's browser history.
I'd guess Kant wouldn't be too happy about that, and Adams neither (since external means are necessary to regulate your exploitation).