I know you can do this because of the AWS Favicon Update add-on. My advice would be to take a look at how it does it by downloading the XPI from the versions page and unziping its content.
Edit: I did so and its mechanism is fairly basic: it’s a content script that replaces the favicon’s URL in the link tag in the document.