Is there some way to dink with them, similar to Matt Blaze's in-band signalling vulnerabilities discovery(s) (http://www.crypto.com/papers/wiretap.pdf) ? You know, use old phones that still have SIM cards, but have them try to register constantly? I'm a bit vague on cellphone protocol details, so spare me the nit picking, and get on with the revelations.