Espressif have replied on their bbs and showed how to access the extra flash memory.
Essentially it seems like the byte[3] stored on the flash can't be used to indicate more than 4MB to the ROM or SDK. However, there's a structure flashchip(.chip_size) which stores the size in bytes of the flash chip, so if you modify that you can access the extra space.
Their example shows you wrapping the usual spi_flash functions with routines that stores off the original value of flashchip before your operation and then restores afterwards - so presumably the SDK will barf if you have flashchip.chip_size set to > 4MB.
I'll give this a go later.
Here's the thread with espressif:
http://bbs.espressif.com/viewtopic.php?f=7&t=2865