I haven't seen it done myself, but are there any examples of people stealing other's challenges off the sandbox to use themselves? what happened to those questions/users?
There are a few different possible scenarios here. Here is how I would expect them to play out.
Scenario 1: Didn't see it in the Sandbox
If you post a challenge that is a duplicate of one already in the Sandbox, without having seen the Sandboxed challenge, technically you have done nothing wrong. It's still a good idea to include a reference to the Sandboxed challenge (to comply with CC-BY-SA's attribution requirement). You will almost certainly be barraged with comments to the effect of "you stole this from the Sandbox!" (and possibly downvotes). Once the Sandboxed challenge is ready for posting to the main site, however, don't be surprised if your version is closed as a duplicate of the previously-Sandboxed challenge - since it went through the Sandbox, it's almost certainly going to be a better challenge.
Scenario 1a: Didn't see it in the Sandbox, also posted it in the Sandbox
If this happens, then there is a fundamental failure of our Sandbox system - it's supposed to allow users time to review challenges and point out issues such as potential duplicates (either on main or also in the Sandbox). If that happened, either you didn't leave it in the Sandbox long enough, or the Sandbox has failed you. Either way, it's likely to go the same route as above (closed as a duplicate of the other challenge once it is posted to main).
Scenario 2: Did see it in the Sandbox
If you post a challenge to the main site that you did see in the Sandbox, if you don't provide attribution, you are violating CC-BY-SA, as well as Stack Exchange's Be Nice policy, because the user that posted it to the Sandbox clearly intends to post it to the main site at some point, and you tried to steal that away from them. Again, expect a flood of comments and potentially downvotes, like in Scenario 1.
Scenario 2a: Saw it in the Sandbox, but it was abandoned.
As Martin pointed out in the comments, we have a protocol for that. As long as you follow the protocol, you'll be fine. If you don't, as above, prepare for the deluge of comments and possibly downvotes.
TL;DR: Search the main site and the Sandbox for duplicates before posting a challenge. It's just common courtesy.