It's a neat idea, but relying on a wordlist means it will just find totally obvious stuff, not all the really random gibberish or just plain non-real-word product name subdomains so often used. Unless those are added to the wordlist manually as well... which I guess still sort of speeds up the process of discovery, but it's still guesswork.