You might also need to worry about referential integrity, although I have only seen this hose up secondary objects that referred to the now-deleted dn.
Examples include the "manager=", "secretary=", or "owner=" attributes, for instance. Where we (used to) get bit by this was in group membership lists, which have dn's as "member=" attributes. Hoses them up *real good* when you blow off a dn w/o cleaning up the member attribute first... rnd
