I know its not where you are trying to go, but with a simple & cheap Arduino clone, you could read the ultrasonic sensor, convert distance to a pulse width modulated 5V signal and feed that via the USB port on the camera to be read by a CHDK script.
USB would probably be better suited than the battery terminal to something like the ultrasonic sensor, but the problem I had with it was that on most cameras the USB port was located right on the side of the hand-grip, making it difficult to hold the camera while something is connected, as well as the likelihood of the plug/socket snapping if the camera is, uh, dropped...
I have conducted further testing on my SX40 and it behaves a little differently than the IXUS65 with regards to how it reads the temperature. The IXUS65 (as mentioned earlier) gives almost instantaneous functions with the get_temperature(2), but on the SX40 it only changes every second (and even then changes are sluggish as if they are being averaged over longer periods of time).
Surprisingly, that address actually worked, the output of
peek(0xc090004a,2) returned a value between 0 and 1023 depending on the resistance. I guess that means they are likely to be the same between other models as well? The values were also reasonably consistent between both cameras. 10 bits of resolution should be sufficient for most purposes I had in mind.
Edit:
I have compiled another table of values. They are attached this time. As expected, the voltage vs value is linear.
All that remains for me to do is to find out how fast I can read the values (maybe fast enough to capture lightning with an LDR?) then I guess I need to write some scripts and make some stuff to make use of it.
Edit: I am considering opening up the SX40 to take out that 18k ohm pull-up resistor that's been bugging me. Then I will be able to measure any high-impedance output I want and get a linear result. I think I'll also add a connection beneath the hot-shoe cover as well, or maybe I should save that for another thread.