@wyardley great questions!
If you create an orb, but only publish a dev version, will it show in the registry?
Dev versions will not display in the registry UI, but they do get published to the registry. This is how we do our standard orb validation/publishing flow (see Emerging testing best practices for Orbs)
Will it disappear from the registry if the dev orb expires without having been published?
Yes, exactly. See Creating Orbs:
Dev versions are mutable and expire: their contents can change, and they are subject to deletion after 90 days.
For testing, it would be nice to be able to publish a dev version of someone else’s orb to your own namespace, even before there is full support for private orbs.
You can definitely do this! 
You’ll need to run circleci orb source $NAMESPACE/$ORB@$VERSION to get the orb source, and get it into a file somehow (e.g., circleci orb source $NAMESPACE/$ORB@$VERSION > orb.yml). From there, you can publish it to your own namespace (if an orb of that name doesn’t exist, you’ll have to create the orb in your namespace first, as well—or you could do something like create a $YOUR_NAMESPACE/sandbox orb, to be used specifically for publishing dev versions of other people’s orbs to your own namespace).
To be clear, @dev versions of orbs are not private—anyone can reference and use them. However, they will not be shown in the registry, and, as far as I know, there is no easy way to get a list of @dev versions of a particular orb via the CircleCI CLI. So, if you keep the details of your @dev:version orb relatively secret, it may serve that purpose for you in a pinch.