To ensure those without referring information, a null or empty $HTTP_REFERER could go ahead and stream the real thing. The remote page will get the file for some browsers, but will be broke for others.

That's a logical and sensible solution, Will. Hmmm.... now why didn't I think of that?? :-)

If your server allows it, a better solution here is to use .htaccess. Being a lazy linux admin, it's much easier to manage a centralized file than to put the code in multiple files where hotlinking needs to be prevented (the server does less work here to). Since this still relies on $HTTP_REFERER, you should keep an eye out in your access_log, then just block the baddies completely using $REMOTE_ADDR or $REMOTE_HOST

#-----Prevent hot linking of images and other file types----------
#requires mod_rewrite
#The next 2 lines may also be required depending on your apache setup
#Options +FollowSymlinks
#RewriteEngine on
RewriteCond %{HTTP_REFERER} !^$
RewriteCond %{HTTP_REFERER} !^http://(www\.)?domain.com/.*$ [NC]
RewriteRule \.(jpg|gif|js|css|swf)$ - [F]

#-Or serve up something else to the hot linkers
RewriteCond %{HTTP_REFERER} !^$
RewriteCond %{HTTP_REFERER} !^http://(www\.)?domain.com/.*$ [NC]
RewriteRule \.(jpg|gif|js|css|swf)$ busted.html [R,L]