Discussion on:

Android smartphone security primer

The article linked below talks about the problem and an app that allows testing of your phone to see if it is vulnerable:

http://www.techrepublic.com/blog/security/androids-permission-system-does-it-really-work/6322?tag=content;blog-list-river

If you lose your phone and don't notice it for just 2-3 hours, or if it takes that long to contact your Operator to block it, the bad guys can run up a bill of $20 000 to $30 000!! I kid you not. They operate as call aggregators and will route vast numbers of international mobile calls through your SIM. So I recommend you ignore Jack's advice and DO set your SIM lock