Researcher Syzmon Sidor has created an app that will stealthily activate the camera on an Android phone. The trick is bypassing the requirement in Android to have a preview window open any time the camera is active. Syzmon’s solution was to make the preview window only a single pixel.
From there, one can use the typical methods to hide the application and have it run in the background. Of course, the attacker still needs to get the app on the phone. Hiding this functionality in some useful app on the Android app store is probably the most likely course.
This would be a good argument for keeping your phone in your pocket or purse, rather than sitting on a table with an interesting view.