Well, first of all you are behind a NAT of a cell phone operator equipment. Secondly, your IP changes frequently - reconnecting to different cell towers will do that (there are many factors to that). Thirdly - there are have to be either zero-day vulnerability or some services running on your phone accepting external requests to be vulnerable.
Phones are ...
Phones without a SIM still talk to the towers whether you make emergency calls or not. They access the cell network for time updates, if nothing else. No "tricks" required, no "finding" required. You can see this if you go into the network settings and look up what carrier the phone is connected to.
So, yes, a SIM-less phone is still very much active and, ...
Wifi and cellular data networks use different hardware. One set won't help positively identify the other.
Some data, like MAC, will expose the hardware type (like iPhone, Samsung, etc.) but that's about it.
What will identify you are your actions, not your hardware.