Is it correct to say, "Vlans define a L2 broadcast domain, and subnets define a L3 broadcast domain"?
I would agree with those terms. However, there really isn't a "layer-3 broadcast domain". A host may choose to ignore what it sees as a "foreign" broadcast, but at layer-2, the host will still receive it. When I first read your question, I thought "layer-2 broadcast domain" vs. "layer-3 broadcast address".
These two hosts are on the same vlan, therefore they should be able to communicate at L2 via their MAC addresses without routing. (Please correct me if I'm wrong)
This is 100% correct. ['tho a Bad Idea(tm). One should always strive to avoid the overlay network.] They can directly communicate, but it takes explicit configuration to do so, because they otherwise have no knowledge of the other network(s) on the wire with them. (this is typically handled with an "interface" route entry, proxy-arp-esq messing with the netmask, or (shudder) full-on proxy-arp.)
