Imagine this scenario: Alice has a private subnet (192.168.1.0/24) connected to a router which is also connected to local network B. Alice's router performs NAT (only using MASQUERADE; outbound traffic will have the router as its source address), but there is no port forwarding or additional firewalling. Mallory's computer is also connected to network B and knows about Alice's configuration.

If Mallory adds a route to her computer (i.e. 192.168.1.0/24 via Alice's router), she is able to run nmap scans of Alice's internal network since Alice's router will happily forward the traffic to the internal subnet.

Dave is on a remote network (one or more hops away) and knows about Alice's configuration. However, none of the intermediate routers between Dave and Alice's router know of the route to her internal subnet (since it is a private range, network infrastructure may be configured to drop it anyway, but let's ignore that for now), so it cannot be scanned in the same way Mallory did. 

Given the exact scenario above and no other assumptions, is there any way for Dave to scan Alice's internal network or otherwise abuse this configuration even though the routing doesn't work out?

Edit: The "router" in this example would be a \*nix machine configured with net.ipv4.ip\_forward=1. The question is based on a configuration I have observed and tested.