I am not sure how it can be effectively done by directly calling the phone line (such as using phone masking services offered by companies), but I can think of a way of doing that using the data line (wi-fi/3g etc) first and then starting the call.
Attacker creates a program which pretends doing something useful, however it also has an activity/screen which exactly imitates the phone call activity/screen. After installed in the OS, program starts a service which tries to communicate (using 3g or wi-fi) with the server of the attacker when needed. When they want to communicate, phone call imitator activity is started and user is deceived with a number like 911. User thinks he/she is answering the call, however in fact he/she is the one who is calling the attackers phone which is obviously not 911.