The command 'no ip direct broadcast' became THE command to have in place back in the day of DoS Smurf attacks. Remember those? Innocent operators of large LANs were used as men-in-the-middle by attackers who would spoof their source address as the address of their victim, send an ICMP echo request to the broadcast of a huge LAN, and then all the devices on that LAN would send ECHO replies to the victim.
So, people put up 'no ip direct broadcast' to quell that threat.
Now, the risk to your network. No, there is no risk, unless Spanning tree is misbehaving and you have a bridging loop somewere. Sending a PING to a broadcast address is basically the same as a switch flooding a frame out all of its ports because it doesn't know the destination MAC address.
You are, in a sense, forcing that to happen in reverse. By pinging a broadcast address, you cause all the devices on that subnet to reply to the ICMP ECHO. The switch will see all those frames and, if any entries in its MAC address table have timed out, they will reappear, thus allowing you to determine the MAC of the device on the port in question.
Best of luck to you,
-Rich
