@Darth_Vader, I am in total agreement with everything rarst said. In addition of WP can write to htaccess then any malicious code running in its context cn write as well, and you just don't want to be in that posisiton.
My generic reply is that looking at the logs for such a thing is a waste of time. You can't prevent people from trying to access "bad" urls. Just a waste of time trying to handle it as there is always some bot that will try a new combination
url/blog/wp-login.php requested 4 times; url/wordpress/wp-login.php requested 3 times; url/wp-content/plugins/user-role-editor/css/ure-admin.css all from the same IP along with 40 other similiar requests within a minute.
so these are some PHP files: CHANGELOG.php, wp-checking.php, configbak.php, modx.php, xmlrppc.php, wp-config-sample.php, wp-content/plugins/500.php, wp-content/plugins/wpfoot.php, mko.php, modules/modules/modules.php. Would these be something to worry about?