Well, on iOS 5.0, there's the prefs://
URL scheme.
From iOS 5.1, that was removed. It's still possible to use private APIs and obfuscation to bypass the static analysis of the binary. Example:
void (*openApp)(CFStringRef, Boolean);
void *hndl = dlopen("/System/Library/PrivateFrameworks/SpringBoardServices.framework/SpringBoardServices");
openApp = dlsym(hndl, "SBSLaunchApplicationWithIdentifier");
openApp(CFSTR("com.apple.Preferences"), FALSE);
By playing with the strings (splitting and concatenating them, etc.) you can eventually make it to the AppStore. It's still disallowed, though.
与恶龙缠斗过久,自身亦成为恶龙;凝视深渊过久,深渊将回以凝视…