You might use low-bandwidth sidechannels. For example, one could set up a site offering pictures, and the site could sport a "thumbnail wall". HTTP protocol allows for requesting those thumbnails in any order, which means that using twenty pictures you can encode up to 20! (i.e., around 60 bits) in the request scheme. There is no way of detecting or blocking such a scheme short of computationally unfeasible statistical analyses, proxying with request order randomization, or HUMINT of course.
A more easily detectable scheme, with more bandwidth, allows encoding information in ETag and Proxy headers.
Then, one could try more cloak-and-dagger schemes: for example one could bounce ICMP packets with faked source address against a trusted (by the government) host. This kind of malicious activity is apparently not (yet) deemed dangerous, and several firewalled hosts will blissfully bounce back the ICMP packet towards the apparent source, thereby penetrating the firewall.
Then again, incredibly, the Great Firewall of China doesn't seem to care about spam. You'd be surprised at the quantity of unsolicited commercial emails, often containing bulky images, reaching the rest of the world from China. Probably, any sufficiently asymmetric traffic towards port 25/tcp is considered symptomatic of the presence of a Chinese criminal, and the firewall has other priorities. Thanks to some helpful spammers in Guangdong, I can confirm that sending back up to 1 Kb encrypted, compressed and base64-encoded error messages has no effect whatsoever, and the incoming connection keeps requesting relay for more and more spam, which is accepted (and discarded). This channel appears to be capable of about 64 kbit bidirectional.
All this requires encapsulating VPN traffic into different protocols, similar to what Haystack did. Other solutions exist - e.g. FreeGate -, but of course the more widely known they are, the faster Golden Shield is going to (try to) bust them. Simpler strategies aimed at defeating a firewall could just entail obfuscating an existing protocol using one-time pad and supplying rapidly changing external endpoints (that's what the ultrasurf utility did), and betting that you can come up with more obfuscations, and quicker, than the GFC people can come up with fixes.
The risk there, though, is that the GFC switch from "blacklist" to "whitelist" operation: first mowing down the traffic to manageable sizes, then actively rewriting rather than rerouting all known protocols, enforcing strong grammar checks and anomaly detection. For example, refusing HTTPS and TLS unless you accept a nonmatching, GFC-generated certificate to allow man-in-the-middle SSL decryption (claiming that this "does not limit responsible citizens", unless "they have something to hide"), and otherwise refusing all packets that it does not fully understand. This is more or less an answer to Ai Weiwei's statement, that the only way to control the Internet is to shut it down. And the answer would be "Well then, how about we do just that".