You can, but you'll probably run into routing issues. The big problem with this is that the return packets from the PIX have to return back out the same interface they came in on. If you have two VPN clients connecting in, and they have random IP addresses from their ISP, when the PIX goes to reply to them first thing it does is look in its routing table to see what interface it should send the packet back. Usually, with VPN clients and not knowing their IP address, the PIX will use the default gateway which generally points out the outside interface.
So, if you have a VPN client connecting to a DMZ interface, you need a specific route in the PIX pointing back to that VPN client machine, and that route has to point out the DMZ interface also. Otherwise the PIX will send the packet back out the outside interface, and it will hit the wrong crypto map and the wrong vpngroup and will not work, which is what you're seeing.
