It pays in these situations to have a look at the intended traffic-flow between the devices on your DMZ. We have several DMZ's where a large number of servers act independently from each other (and do not need to communicate directly) For security reasons we want to ensure that they cant, so we implement private vlans on the DMZ switch so that the variuous switch ports can only communicate to the firewall(s) at layer 2. Because the firewall won't do redirects or same-interface routing, that means the DMZ hosts can't communicate with each other.
Thats the cheaper way of doing large DMZ's, however, for govt clients this doesn't offer an accredited level of separation between hosts, so where accredited separation is required, more firewall interfaces it is.
