A weakness in the iPhone passcode mechanism allows anyone with access to the handset the ability to make calls when the handset is locked.
To reproduce the bug, make sure to have a passcode lock turned on and lock your device. In the lockscreen, tap on Emergency Call in the lower left corner. Now type a non-existent emergency number, I tried #946494. Start the call, and as soon as the red button appear hit the sleep button. You'll be brought to the contact list.
It turns out that it's also possible to access email.
I can confirm that this workaround does indeed work (although you have to be really fast hitting the sleep button).
It appears that iOS 4.2 beta blocks this "workaround."
This needs fixing - FAST!