Once you find a host on a /48 jump to the next one I guess. Or make some guess on what IP addressing scheme is being followed and which subnets of that /48 are being used [assuming that an end site like a cellphone carrier decides to give v6 IPs to all its phone users] ... scan from within the network.
I dunno... it seems to me it'd be pretty hard to configure 1,208,925,819,614,629,174,706,176 toasters (or any combination you prefer of other devices) within any reasonable definition of "lifetime." I suppose if one were sufficiently motivated to develop some automated tools for configuration, it'd be possible - but I suspect the power company might notice the small power blip if I plugged in all those devices (personal nuclear plant, anyone?) Sure, with some incredible luck, you could find all those devices while you're scanning - just seems like some are crying that the sky is falling already.