I concur with most here. While information security may still be in its infancy, applying for a credit card with information that is not your own boils down to simple fraud whose laws are well established. By going through with this just to "prove a flaw" will only make the prosecution's case against you stronger. Vigilante's are still not embraced by the legal community.

On a positive note, I believe that Ancestry.com may be in violation of something here, and by notifying them of their mistake they may be much obliged. If they blow you off, talk to a lawyer.