NO.
It will create an infinate loop, that much is true. The attacker's html page is loaded. Let's say it's 40KB. From there, the victim's page SHOULD be loaded. But it isn't, because it is blocked by htaccess. The ONLY thing loaded from the victim's server is the htaccess file when it is read by the visitor - let's say, 200 bytes. Nothing else. That htaccess denys the visitor, and tells the browser to go back to the attackers site and reload that 40KB page. For every 40KB read on the attacker's machine, 200 bytes is read from the victim's machine.
Over 5 loops (yes, the loop is infinate, but this is a fucking example)...
Attacker, Victim
40KB, 200 bytes
40KB, 200 bytes
40KB, 200 bytes
40KB, 200 bytes
40KB, 200 bytes
_______ Totals:
200KB, 1KB
200KB loaded from the attacker's machine, 1KB read from the victim's machine. It's easy to see that the attacker is in a worse situation than the victim. ;-)
Yes, it could be directed elsewhere. Like to an image file on the attacker's server. But why bother.
