what you are asking for will not work until IIS7

you need the whatever.aspx file so IIS6 knows it is the ASP.NET pipeline you need

otherwise you could rip out the friendly url feature and replace it with your own solution (alot of work, and still limited by IIS6)

the child portals hack works because a child portal makes a subfolder in your install containing a default.aspx file wich redirects to the root default.aspx

in theorie, if you would make a subfolder tree in your dnn wwwroot containing default.aspx files that add the necessary values to the querystring parameter collection and then do a server.transfer to the root default.Aspx file, what you ask for could work. It's an ugly hack but it could work (no guarantee, I am making this up as I type)

this should work because IIS knows the path exists & default.aspx is in the default documents
you would need to set at least the tabid in the querystring collection and then server.transfer (not redirect)

when you do this you would have clean entrypoints into DNN, altough when browsing thru DNN, DNN would contineu to use the standard friendly url's

I hope this inspires your *hacking* session's