[speleding]

If I read the documentation correctly there is an important limitation that would prevent sending non-SNI browsers to another https URL: As soon as you associate a custom SSL certificate with a distribution then that distribution will no longer be available under the old SSL name (https://d111111abcdef8.cloudfront.net/...)

I'm not 100% sure about this but I conclude this from the description where they explain how to undo setting up custom SSL certificates and they warn that you need to create a new distribution.

[imperalix]

You are correct. Once you set your distribution to SNI only and the distribution is in deployed status, clients that do not support SNI will not be able to access your distribution over https.