Here's an interesting attack: Suppose there are three non-overlapping channels and 70 APs, most/all of which try to pick the least congested channel. Can you persuade 67 of the 70 APs that a particular channel is very congested and best avoided, while leaving that channel uncongested and usable for the few remaining APs? Can you do so without client cooperation from the three favoured APs?