I've built a simple Twilio script that shows how easy it is to exploit this here: http://edlea.net/

Vistors on an O2 phone will receive an SMS on their first visit. An MD5 hash of their MSISDN is kept in memory to prevent multiple SMS being sent.