The perps could have been vaccinated, as part of the terrorsit bio-attack program.
They infect the candy, then sneak it back into stores. Unsuspecting people buy it and distribute it on Halloween.
Not if they have the vaccine. Any state working on smallpox as a WMD would more than likely also be vaccinating their workers. Same is not necessarily true of the terrorist in the field. That is why another scenario may be more likely.
Terrorists have already been flying to multiple cities in one day planning attacks, judging by records already released of their activities.
Take a handful of terrorist martyrs, infect them with smallpox, and send them at the point they are most contagious on a cross country trip, transferring flights at all the busiest airport hubs.
Relatively few infected martyrs could start an multicentric epidemic, but they would be dead before the authorities knew there was an outbreak.
Let's look at what we do know about their MO.
There are massive amounts of envelopes of "white powder" being mailed, and a few of them contain anthrax.
This is really not very innovative. The USSR was set to throw massive amounts of "decoys" at us if they ever launched "the big one". The idea was to make it impossible for us to pick the real weapons out of the mass of incoming items.
Radar "chaff" is another variation on the theme.
So, what would happen if they bought thousands of pieces of candy, and only infected one out every 250 or thereabouts?
I'll tell you what would happen: they'd cause an astronomical amount of terror.
And as to them "dying in lingering agony from the affects of smallpox", think about it. All they'd need to do is get innoculated prior to handling the virus!