What I was thinking of was figuring out how to make the incoming and outgoing ports match on both sides beforethey were actually sent. It's likely that that would be in violation of the DMCA, though, and therefore probably unsalable. It would also depend on knowing how the firewall rewrote those packets. Since they often rewrite port numbers in addition to IP addresses, you'd still have to have someone on the outside looking to see what those new port numbers were in order to generate them properly on the other side, and if both firewalls did that, which isn't unlikely, then you'd be totally screwed.

However, you could figure out a way to write a custom IM app that was specifically built to transfer files via the IM service itself, but most IM services have a jabber-killing feature whereby if a client talks too much, they get cut off, so you'd have to pipe it through slowly, which wouldn't be ideal, either.