I don't think you'll be able to do this without using URL Scheme
[[UIApplication sharedApplication] openUrl:[NSURL urlWithString:@"yourUrlScheme://"]];
Cons : You need to register it in advance, or to know the URL Scheme registered by an app
You can find a list of some URL Scheme here or here
For other apps, you'll have to extract the .ipa. Here is a way to do it (from that SO answer) :
So I went to iTunes on my mac and looked in my App Library for the "APP IN QUESTION".
I then: • Right-Clicked on the "APP IN QUESTION" app and selected “Show in Finder”
• then duplicated the "APP IN QUESTION" .ipa file
• Then I renamed the .ipa file to end in .zip instead (saying, yes make it a .zip if necessary)
• Then I unzipped it to a folder
• I opened the Payload Folder
• I right-clicked the “"APP IN QUESTION".app” and selected “Show Package Contents”
• I opened up the “Info.plist” file in a text editor like the free TextWrangler.app
• I searched for “URL” and found the following:
<key>CFBundleURLTypes</key>
<array>
<dict>
<key>CFBundleURLSchemes</key>
<array>
<string>app-in-question</string>
<string>sslapp-in-question</string>
</array>
</dict>
</array>
I was then able to successfully go to Safari and type in: app-in-question:// and sslapp-in-question:// and was prompted if I wanted to launch the App in Question.
EDIT:
This should work
void* sbServices = dlopen("/System/Library/PrivateFrameworks/SpringBoardServices.framework/SpringBoardServices", RTLD_LAZY);
int (*SBSLaunchApplicationWithIdentifier)(CFStringRef identifier, Boolean suspended) = dlsym(sbServices, "SBSLaunchApplicationWithIdentifier");
int result = SBSLaunchApplicationWithIdentifier((CFStringRef)bundleId, false);
dlclose(sbServices);