Seems that if you drilled a hole from the underside of the board, you could remove the BGA pad. Careful cleaning of the hole wall should eliminate any shorts. Then, a thin pin with a teflon sleeve could be poked into the hole and soldered to the device ball.
Yes, this is all microsurgery, but if it is just one unit to test that the device and rest of the board works, it ought to be doable.
Of course, there is the possibility there are inner-layer traces right at that spot that you'd end up drilling through, so that could wreck the whole idea.
Jon