In part 2, Khorayt doesn't activate until he is attacked or a hero/Alric fails the test. Does the attack have to actually hit or even have a chance of hitting in order to trigger the activation?

Strictly speaking, an attack which fails is still an attack. The attacking figure doesn't get his action back just because it failed, so there's some wiggle room to argue that the target has still been attacked even if it missed. Even if it never had a chance of hitting in the first place.

However, in order to perform an attack, even before rolling dice, the attacker must declare his target. There are rules for which spaces can be targeted. For starters, all attacks require Line of Sight . So nobody can attack Khorayt from the entrance tile. In particular, a melee attack ( you know who you are, Alric ) must target an adjacent space . So you can't wiffle your sword from across the room and declare Khorayt to have been "attacked." Assuming we're talking about a ranged attack, however, the only real restriction on targeting is that the target must be within Line of Sight. Nothing says the target must be within the theoretical maximum number of spaces the attack could possibly reach. Anybody with a ranged attack could probably get a bead on Khorayt from the far side of the frozen room, barring other figures standing in the way.

Personally, I'd say the attack should, at the very least, not miss. But per RAW, the lawyers do have an opening to pursue.