One attack is that you can override the content of email and then send invite or welcome mail that says whatever you want, whether the victim has a Phabricator account (welcome) or not (invite).

This attack email lets you send email from Phabricator, and send email to Phabricator users without direct knowledge of their email addresses.

But it's not magic: the other 99% of the attack is still just social engineering. A somewhat-similar "attack" is already possible where you send invite email, don't replace the text, and just add your attack content as the welcome message, so users get email like this:

Welcome to Phabricator! alice has created an account for you.

type ur password in this box ➔ ➔ http://evil.com/password-stealer.html

To login, follow this link: ...

We reject these reports on HackerOne as uncompelling, since it's difficult to imagine a victim would actually fall for this.

A similar attack is to just create a wiki page called "Important IRS Notice" with content like:

Important IRS Notice
This is an official notice from the IRS. You will be executed by the government if you do not follow these instructions.

type ur password in this box ➔ ➔ http://evil.com/password-stealer.html

Using translation.override is definitely a little better than these attacks, but it doesn't feel like a significantly different class of attack to me.