Just to summ up / that attack would be like that:

A miner

1) modifies his own mining code to enter  already the SW link into the correct place

2) mines a BAD block NOW, Long time before SW goes live

3) Now he can do lots of real txs like spending BTC (but get back when)

4) SW goes live and all blocks down to his BAD block get orphaned and his spending from 3) are neglegted

? correct ?