Enabling password protection on your iPhone is not enough.  If you double-click the Home key while in the Emergency Call screen, the iPhone defaults to your Favorites menu. From there, anyone can access your email by just clicking a contact’s email address, click "Cancel" from the new message screen, and they’re in, browse the Web through a contact’s URL, or through URLs found via Google Maps, and make calls by just dialing a contact’s number then add a call.

According to Ars Technica, posters on the MacRumors forums discovered the security hole.

The solution? Just change the double-click preferences for the iPhone Home button (Settings>General>Home Button) to "iPod" or to "Home", which simply brings the iPhone back to the password screen.