Name servers do not route anything. Name servers respond to requests for names, and they eventually returns an IP. CNAME records return a name, which is then looked up to get the IP. The only thing you really can do with your DNS records is make sure that your name is set returns the IP address of a server that will accept the traffic and do what you want.
If you setup the web server with name-based virtual hosting setup, and the main name for that virtual host is
somethingelse.com then you could set an additional name for that virtual host
subdomain.example.org. In DNS you set the records to return the IP of the virtual host serving
The web site hosted on
somethingelse.com must used relative links wherever possibly or the user will quickly realize that they are now have been switched to a different domain.
... this is the crucial point. How would I do that?
Just create an A record that associates a name with an IP, or CNAME record that points to an A record that points at the IP you want.
DNS knows nothing. What you are asking for needs to be handled on the HTTP server.
Otherwise I could direct my domain at google.com and make it look like it's my site?
You can point a DNS record at any IP address you like. In the case of HTTP, part of the request includes the host name you are trying to access. The Google web servers may choose to reject based on the hostname that is part of the HTTP request.
Setting up a DNS name to point at Google's servers is even supported if you are a Google Apps customer. There is a procedure you most follow to tell Google what name you will be using for a particular page. Google then adjusts their configuration accordingly.
If you are using some other protocol that doesn't include the hostname used to access then the server would have no way of knowing what is what. You can easily test this for yourself by creating a record like
googledns.example.org IN A 22.214.171.124, and then running
ping googledns.example.org, Google's DNS server will respond to the ping. The name you used to for the ping command is not included in an ICMP echo reply at all, only the IP address.