The ease of use iPhone integration that allows you to dial numbers, look up addresses and send emails directly from links in Safari may actually be the iPhone's downfall. By formatting a "dial" link incorrectly so that the webpage shows one number, but the actual number being dialed is something else, exploiters can make you place expensive 900 or overseas numbers without your knowledge.
In fact, those numbers could then route to the actual number you want to dial, so you wouldn't even know the difference. To avoid getting shafted until Apple comes up with a fix that shows exactly who you're dialing before or during the actual dialing process, you should limit your webpage click-to-calls to trusted sites like Google Business or Yelp. Dialing numbers off of Google Searches, on the other hand, probably isn't a good idea.