You can to it pretty easily once you have a reference to the MessageBroker, and fortunately since the MessageBroker is just a Spring bean, that's fairly easy to do...you could either autowire it by type, inject it by referencing the default id (see org.springframework.flex.config.BeanIds), or inject it by assigning it a custom id with the <flex:message-broker> tag and referencing that.
Once you've got a reference to it, you can get to the remoting destinations like this:
The key set in that map will be the ids of all of the remoting destinations.
RemotingService rs = (RemotingService) messageBroker.getServiceByType(RemotingService.class.getName());
Map remotingDestinations = rs.getDestinations();
Staff Engineer, Web Products Team