Last year I discovered a bug that allowed you to call someone's phone and remotely activate it's camera and mic by disconnecting the call while it was ringing - the target's device would simply call you back as if it were a dropped call.

They fixed it, but boy that was a doozy.