But the Robert Morris worm wreaked devastation with a 350 word dictionary (and some mangling). And it don't think passwords have changed that much since the late 80s.
(http://www.ieee-security.org/TC/SP2012/papers/4681a538.pdf)