Seems to be one of those Areas of Great Concern. Suppose the Vegas nutter had thought of that????
Let us consider. Adapting a largish quadcopter to carry and drop a ~1 pound payload would take some skill and effort, but seems plausible (especially if the control system has extra channels intended for, e.g., controlling a camera gimbal).
An M67 grenade weighs in at a bit under a pound, and has a kill radius of about 16 feet. So! Assuming each drone is capable of delivering one-each M67-equivalent grenade into the crowd, how many people could he have killed for each drone he bought and adapted?
If your calculation starts with "how many people can be packed into a 32-foot circle*", you've got hold of the wrong end of the stick.
You know that cliché where a soldier throws himself onto a grenade to save his buddies? That ain't something Hollywood made up. It actually works. A body makes a very effective shield against a grenade-sized explosion.
I'm thinking that, in a densely-packed crowd, each grenade-dropping drone could kill 4-10 people, and injure many more (not counting injuries sustained as a result of the ensuing panic).
Doesn't sound so plausible for a mass-casualty attack. Not with little hobby-shop flying machines, at least. But that doesn't mean that some enterprising terrorist won't do the wrong math and try it anyway. And the terror effect (if not the body count) might prove impressive.
* Mumble, mumble... 16-foot radius, squared, is 256, times 6.3-ish 3.14-ish, duh gives 1600 800 square feet; at not-quite-sardine standing density of 3 square feet per person, that gives 500 250 or so people inside the circle. Sanity check: 22000 people in 2 acres works out to about 4 square feet each. (Correction note: I am not wearing a 2π!)