I am not sure if there are verified reports, but I would be shocked if there were not any man in the middle attacks.
It's super simple to do. Compromise the vendors payment processing (exploit a security hole on the vendors web werver. if the wallet address is generated from a local bitcoin instance, an atacker could point the address generation code away from the vendors instance and towards their own malicious bitcoin instance... Or the malicious user could just hard code their own address in to the payment processing. Depends on how intricate it needs to be. You could even compromise the vendor by having a copy of their wallet, watching silently for a large transaction then running once you find a big haul of coins.) you could compromise their payment gateway api and have it redirect to you(or your coin address) instead of the vendors address. or if they use email: simply compromise the communication protocol (email/web support ticket/etc) and replace the merchants address with yours.
A script kiddie sadly could (and probably has) executed one or all of these methods of attack... There's a ton of ways to do it. Those are just a few off the top of my head.
Be safe. Do not try any of this! This information is posted so you get an idea of what to keep in mind.