Ok, I have been all over the net and it seems this trick has been tried and can succeed.
I am trying to tunnel a VNC session through a secure shell. What I have are 2 windows XP boxes and a linux server in the middle for the shell.
I establish a tunnel for the server localhost:5900 and tell it to forward to 5900 on the linux machine. Client Establishes an outbound tunnel to 5900 on linux machine:
vncserver (listen 5900)