This is possible
when the addresses are obtained by SLAAC and a part of the
MAC address is known (e.g. the manufacturer specific part).
Also some reconnaissance attack optimizations are proposed,
tested and evaluated. These include overflowing the MAC
table of a switch so it becomes a hub and pretending to be a
router or root bridge so nodes contact the attacker themselves.
Furthermore they successfully test a denial of service attack
which prevents a node from assigning an IPv6 address to itself
by spoofing messages from potential IPv6 addresses of the
target and thus preventing the target from auto configuring an
address.