All you need to do is infect a few phones. They will then send the infected SMS to all the phones in their contact list (some of which will be iPhones), which will then send the infected SMS to all of their contacts, etc. That probably covers 80% of all iPhone users.
Of course, the networks would likely be able to put a stop to this by filtering SMS messages containing the payload, but that would take some time and cooperation. If someone launched an iPhone worm, it would be likely that almost everyone was infected before AT&T and others had time to implement a patch.
If I were Apple, I'd be working ASAP to get AT&T to start working on the filter, because at this point, even publishing an iPhone update is not going to be enough.
You'd have to be able to send a text message to every iPhone in the world in order to hijack all of them.