I agree about being able to use named pipes, etc. as HISTFILE. My concern is that I think there may be a code path that leads to rename() and open(O_TRUNC...) being called on something that isn't a regular file. Furthermore, I think that if someone can manipulate a user's HISTFILE setting maliciously, there may be a code path to cause an unwitting overwrite of a file whose name ends in hyphen.
Specifically, if lib/readline/histfile.c:{append,write}_history() get called, in turn history_do_write() is called, which results in an open with append or a trunc, and when overwrite is set, a rename to HISTFILE + "-". It doesn't look like the return value from rename(output, bakname) is tested, and if the open() on HISTFILE fails, it does a rename(bakname, output) to "restore" the backup, also not checking the return value from rename(). I believe this could even do something bad such as renaming /etc/shadow- to /etc/shadow, clobbering the current /etc/shadow, etc. (assuming you are root).
Aside from the case where the user running bash is root, I think it's not uncommon for users to have group write access to a variety of things in /dev.
If I can get some time, I will play around with it over the weekend and see if I can confirm my suspicions.
-Jonathan Hankins