PF doesn't implement any ALGs by default. To my knowledge, it doesn't even have any ALG capability. So, this type of attack would not work through a NAT implemented by PF unless you have separately added an ALG via hooks (like ftpsesame).