I don't think that this is possible.
It's actually possible as long as the same exploits that allow websites like "Jailbreakme" to jailbreak your phone without ever plugging it in (although Apple is quick to close this class of security hole).
There are just a few hoops you have to get through first:
1) Need to exploit an app on the device.
2) Get out of the app sandbox (which Jailbreakme was able to do).
3) Edit the filesystem to include a new app, hide it.
4) Kick off the app.
5) Profit.
Keep in mind, Jailbreakme actually did all this. Right now, it seems that Mobile Safari does still have flaws in this category, although I'm not sure how far down they can get into the system with these exploits.
That all said, the odds of this actually happening are small. The exploits aren't in the wild, it isn't certain that they can escape the app sandbox (the Pwn2Own competition wasn't clear here), and there are better targets than the camera (account information, password, CC#s, etc).