Yes, reading the full host list is a valid work-around. Unfortunately though, backticks exhibit the same issue with STDIN being consumed by the ssh command. Ultimately adding -n to keep it from sucking up STDIN is the solution.

Regarding the redirection in the shh command, normally your assumption would hold true as in the 'uptime' test case, but alas, the third party program I'm dealing with on the remote systems in the real use case was not written with proper *nix philosophy in mind and writes most of it's "output" on STDERR.