yeah, that's a great question...
It seemed to me that when i first turned on my phone and tried the Maps app for the first time, it somehow knew where i was. I was out of my billing zip code when i did this, so i was totally impressed that it loaded my local area. So i guessed that it used tower info.
And ever since, i've been wondering how to make it do that on command. I did a restore recently, and i'm pretty sure it reset the maps app and did the same thing again.
Anyone looking in the opened firmware see anything like this?