In the early days of the iPhone development apps are often kicked out of the AppStore for using undocumented API calls. I always asked myself how people found out about these methods and what they do. I know a little about Objective-C and I know you can send any message to any object or you can even check if an object will answer to a methode by calling respondsToSelector. So its seems using undocumented API calls is not the problem but I have no idea how to find them.
BTW I don't want to use undocumented APi functions. I only want to know how oit is done. Can be useful when working with third party frameworks. Or maybe someday people will use frameworks I created.