I know you have heard this question multiple times over and over again, but I have some good hard proof this might be possible (Without Source-Mod Even). So in my research I have decompiled some TF2 CTX weapon files and noticed just a few tiny things that I'm sure you all know of.
Code:
// Animation.
"viewmodel" "models/weapons/v_models/v_smg_sniper.mdl"
"playermodel" "models/weapons/w_models/w_smg.mdl"
"anim_prefix" "ac"
Now in my editing (Changing the w model) I have been stumped by an md5 checksum.
[IMG]http://img682.**************/img682/7413/testcg.png[/IMG]
This did not stop me, what I did was found a mod that uses the orangebox engine that doesn't md5 checksum it's models which would be called Goleneye:Source as you can see in the picture below I change the w model from the manual shotgun to the auto shotgun.
[IMG]http://img716.**************/img716/9994/hehez.png[/IMG]
So this tells me right here if you can get past the MD5 checksums in TF2 custom skins will work as long as you use a custom model or decompile valves model and change all the textures on it, therefore giving you a custom skin. So after this I decided to see if I could get v models, so all I did was change the v model on the manual shotgun and when I started the game up and as soon as I joined and spawned ge:s crashed. So I started to wonder why this was happing which all of you know v models are client side but when I got this CTX file from my server with the custom model and put it in my client side it worked, but you all know the issue with this. This will permanently change the model the player sees. To solve we would need to change the the CTX file LOADED when the client connects tot he server therefor giving you custom v models. I would not know how to change the CTX file loaded but I'm sure it can be done with a custom source-mod extension.
I would also like to state that all v models are client side w models LIKE player models are server side. The reason no one has ever got custom models to work though editing the CTX file is because of a MD5 checksum that no one bothered to change.