Do iPhone apps have permission to make calls without user interaction?
I've experimentally checked the iOS behavior by trying to initiate a phone call from one of my apps.

Here are the results:


It is possible to programatically start a phone call without user confirmation. I've just written a single line of code that is executed right after the App has been loaded. Meaning that if your App is in the foreground it can start a call at anytime, even without needing user to tap anywhere. 
I've sent a silent remote push notification to the App in order to wake it app if it is not running, and then execute the same code. No call was started; iOS does not allow an app to initiate a phone call if the app is running in the background.


So answering your questions, the only way to start a phone call without the user noticing it, is by somehow convincing the user to leave the malicious application running in the foreground, and then start the phone call, as iOS won't allow this operation if the app is backgrounded.

Currently iOS does not provide any mechanism to block starting phone calls from a particular app, but it can only happen if the app is in the foreground.