Well, the DD-WRT guys managed to do it (booting MEGA images on 2MB flash routers), by basically using the base firmware as an big initrd.
See the thread: http://www.dd-wrt.com/phpBB2/viewtopic.php?t=44448
Can anyone chime in if this could work for TomatoUSB? Would be nice to have a "Test Firmware" panic button instead of a "Brick Router with a broken build" button.
Although I wonder what would this do to the CFE/NVRAM once you start making the changes that tell it to resize.