Anyway, I have needed to generate a 400 error on a server in order to test something - I tried a few things without success and then I discovered that the easiest way to generate a 400 error from a client is simply to add a percentage symbol (%) to the request.
For example, http://mysite.com/% should generate a 400.
Before I found out I could use the percentage symbol, I was looking for a method involving telnet/direct connections. Oliver Salzburg on Super User came up with the following -
... I don't know if this will help anyone, but, if I had found a post like this earlier today, it would have saved me quite a bit of time, so, I hope someone will find it useful!