Yeah, this is definitely not supported with flattening via the flattenSpec as described here
http://druid.io/docs/latest/ingestion/flatten-json. If you know the upper limit of occurrences, a poor workaround would be to add a json path expression for each '$.xyz[n].id' mapping to 'xyz_n_id' up to that limit and have null values for rows which do not contain these values.
I've been investigating enhancing the flattening abilities of Druid ingestion when dealing with nested lists to be able to 'explode' out one row with nested list data into multiple rows, distributing list elements one per row to flatten, but this type of flattening lists into a single row also seems potentially useful so I'll take it into consideration. I unfortunately don't have a timeline on doing this work, it's just something I'd like to take a look at in the near future, so I can't make any promises as to when such functionality will exist.
As for the javascript parse spec (which I forgot even exists!) I looked through the code and it would appear that if you can write a function that will take a json string, parse the json string into an object inside of this function, and then transform that object to your desired flattened output map, it should work. Disclaimer: I haven't used this functionality personally so I'm unsure if this will actually work, and even if it does I would expect some amount of performance hit for the extra overhead of running a javascript function on every row. For further information, the details of using javascript parse spec is described here
http://druid.io/docs/latest/ingestion/data-formats.html#javascript and general usage of javascript with Druid here
http://druid.io/docs/latest/development/javascript.html.
Good luck!
Clint