Private API
There is a private API to get phone number. Private API can't be submitted to AppStore, but it can be executed on jailed device.
NSString* CTSettingCopyMyPhoneNumber();
It returns phone number. And it's located in CoreTelephony
MDM
And actually, there is even a legal way of getting phone number. However, it's complicated. There is MDM protocol for iOS. One of the commands retrieves information about a device and this info includes phone number (and a lot of other device info).
Other notes
Also, you may be interested to read through these several questions:
Programmatically get own phone number in iOS
How can I get the phone number of my iPhone device?