Active scanning for known base stations is a 'feature' most people don't know about either. You phone actively tries to connect to base stations it knows, opening you up to attacks from devices like the WiFi pineapple.