If there's any sort of oscillator still running in the phone, or any other circuit switching with a predictable pattern of rising/falling edges, you'd think it might be possible to pick up EM radiation with a sensitive enough receiver/antenna.

A bit more "out there", maybe it is possible to pick up a powered down antenna? Think that an antenna is a (typically passive) conductor, designed to resonate at a particular frequency. If the antenna is irradiated with that frequency, wouldn't the antenna couple to the field and disturb it is some way? If those disturbances can be measured, then the antenna (and consequently the phone) can be detected.