A few years ago I've written used a little program to mount my pendrive when kernel-hotplug activates it via /sbin/hotplug interface.
It activated on condition $ACTION="add" and param="scsi_device", used $DEVPATH to determine the USB-informations (vendor, product, serial).

(Example:
DEVPATH: /class/scsi_device/6:0:0:0
sys/$DEVPATH/device pointed to: /sys/devices/pci0000:00/0000:00:1d.3/usb4/4-1/4-1:1.0/host6/target6:0:0:0/6:0:0:0
files idVendor, idProduct and serial can be found in /sys/devices/pci0000:00/0000:00:1d.3/usb4/4-1)

Also there was a symlink called block:sdX in /sys/$DEVPATH/device which told me the device (sdX) to use.

Now I've upgraded my kernel to 3.2.5, which changed a few things:

DEVPATH: /devices/pci0000:00/0000:00:1a.7/usb1/1-2/1-2:1.0/host17/target17:0:0/17:0:0:0/scsi_device/17:0:0:0
/sys/$DEVPATH/device points to: /sys/devices/pci0000:00/0000:00:1a.7/usb1/1-2/1-2:1.0/host17/target17:0:0/17:0:0:0
files idVendor, idProduct and serial still can be found in /sys/devices/pci0000:00/0000:00:1a.7/usb1/1-2,

but nothing gives a hint about a the block device to use.

The solution I think of right now is intercepting both scsi_device/add and block/add in /sbin/hotplug, at the first one (whichever it is) only store informations, and at the second actually do the mount.

Well, no, I was wrong, at hotplug-event block/$ACTION=add /sys/$DEVPATH/device is still a symlink (e.g. /sys/block/sdb/device) that points to /sys/devices/pci0000:00/0000:00:1a.7/usb1/1-2/1-2:1.0/host17/target17:0:0/17:0:0:0 (or something like that), from which /sys/devices/pci0000:00/0000:00:1a.7/usb1/1-2 can be deducted, and from that directory USB information can be collected (from files idVendor, idProduct, serial).