1.) Listening in on GSM calls. 2.) Yep. 3.) Well, kinda.

It's a motivated attacker attack. You have to be within radio range, and the attacker has to have specialized equipment and knowledge. It's not like an internet vulnerability, where one guy in Russia can exploit every single unpatched system in the world; this requires a bit of fieldwork. I wouldn't be worried unless you work for Apple, or something.