Bad idea. Disney takes the fire code seriously, and they will not allow you to exceed the fire code occupancy limit for the room.
They're going to lose a couple of major advantages of staying on site. One member of their party will not be able to participate in Extra Magic Hours at the park - each person on the reservation gets a resort ID with their name on it, and everyone must show a resort ID to get access to EMH.
They'll also lose access to Magical Express, Disney's free transportation from the airport to their resort, for the same reason. If you're not on the reservation, you don't get a voucher, and you don't get on the bus.
And, as PPs have said, Disney is within their rights to require you to pay for an extra room, or require you to leave the resort.
They can book a family suite at All Star Music, which will allow up to 6 people on the reservation. Or, they can book a trundle bed room at POR, which allows up to 5. If it were me, I'd go for the room at POR that legally sleeps 5, since they're considering a moderate anyway. Why do all that sneaking around when they can just book a room that sleeps 5, and actually has sleeping spaces for 5?