There was a
Dutch/English web shop (voti.nl) that sold USB VID/PID from a pool he owned, but he was ordered to stop selling those licenses.
Dangerous prototypes has done a presentation about USB in open source hardware, and how problematic it was. The options they mentioned for a product such a bus pirate were to use a microcontroller like Microchip, that allows people to lift on their VID or use chips like FTDI which uses proprietary drivers anyway and let them handle it all of it.
They also mentioned collaboration projects with VID/PID and most of them were eventually taken down. However, this presentation is some time back (1-2 years?) so things may have changed, but certainly the USB organization is not very on these things (nor helping themselves).
I personally wouldn't give a toss and would just use any number I find convenient. At a company we had this product that occasionally would be connected to a customer (or our PC) for software servicing and setup, and used a 4-port FTDI chip. To make it more identifiable, I changed the VID/PID to something from the "dead list" and voila, we give it a nice name in device manager and name each serial port (with 4-port FTDI chip it's nice to know what's connected on what!).
The volume is very small of this product, we are on SN# 19 after 3 years. A licensing fee of 5k$ over 20 products would triple the cost. Ouch.
Doing this is OK in Windows Xp/7, but in Windows 8 the FTDI drivers become unsigned (VID/PID doesn't match) and become a pain to install, especially on normal consumers PC's (which may not be running Windows in Test Mode). But I guess that is applicable for many custom VID/PID drivers.