i have the same issue on android, not only on iphone, and I have solved (at least for Android) by escaping the string:
<button class="phoneCallButton">click me and call an hash number</button>
$(document).ready(function(){
$(".phoneCallButton").click( function()
{
window.location = 'tel:'+escape("*123#");
}
);
});