Can 64b/66b be forced out of DC balance by malicious data?
Yes, absolutely.
The scrambler produces 64 bits of output from 64 bits of input, which means there 1:1 mapping of inputs and outputs, and thus there is an input which produces all 1's as output. The preamble will force a single "0" every frame, but still, the DC balance will be way off.

As for the state, the scrambler is self-synchronous based on in-band data, and requires 64 frames to synchronize. Which means if you send 64 sequential frames (512 bytes of data), you will know the exact scrambler state. This is trivial to achieve -- just send a single long ethernet packet.