tldr:

1) LTE uses broadcast messages to do push notifications. These are unencrypted and unauthenticated. Researchers can trigger them silently by spamming you on Facebook, and triangulate your location since the LTE network only sends the pages to the geographic location you are in.

2) LTE supports crash reports that can potentially include your GPS coords. A rouge base station can request these from your phone without setting up an encrypted channel due to shitty baseband implementations.

3) something about denial of service

the excellent paper is here: http://arxiv.org/pdf/1510.07563v1.pdf