I'm sure this is a conceptual error on my part. I understood the idea of a replay attack as being the capturing of a txn body with its signature on one chain and 'replaying' it on the other (ETH to ETC or vice versa).
What I don't see is how an attacker can benefit from this assuming the txn body signature has the destination address embedded in it. Wouldn't the attacker have to control that specific address to get the coin value?
How can an attacker use a txn body signature to validly send value to his own address?