Where I live, it is possible to setup a call to virtually any
> destination number using the format:
> [+] 1 - 611 - [NPA] - [NXX] - [XXXX]
> and after a few unsuccessful attempts (diverted to intercept recording
> that references "0 7 7 P" at the end) ... calls will ring through.
Since you don't mention where you live or which cellular company you are using no one can make a check with any authority. I tried the number sequence you have as above with both a T-Mobile prepaid and a T-Mobile postpaid monthly line and all calls placed in the sequence listed get an error recording from T-Mobile. Perhaps you could give a little more detail such as where you are and which service you are using.
The reality is that a company is not very likely to leave a big loophole in their service to allow unbilled calls. What you describe sounds a bit suspicious to me.