Programmatically send iMessage using private frameworks

I haven't tested this, but look at the code posted here. If you look at httpResponseForMethod:URI:, you see where he/she sends a message (appears to be hardcode to support iOS 5 or iOS 4):

CKSMSService *smsService = [CKSMSService sharedSMSService];

//id ct = CTTelephonyCenterGetDefault();
CKConversationList *conversationList = nil;

NSString *value =[[UIDevice currentDevice] systemVersion];          
if([value hasPrefix:@"5"])
{
    //CKMadridService *madridService = [CKMadridService sharedMadridService];
    //NSString *foo = [madridService _temporaryFileURLforGUID:@"A5F70DCD-F145-4D02-B308-B7EA6C248BB2"];

    NSLog(@"Sending SMS");
    conversationList = [CKConversationList sharedConversationList];
    CKSMSEntity *ckEntity = [smsService copyEntityForAddressString:Phone];
    CKConversation *conversation = [conversationList conversationForRecipients:[NSArray arrayWithObject:ckEntity] create:TRUE service:smsService];
    NSString *groupID = [conversation groupID];           
    CKSMSMessage *ckMsg = [smsService _newSMSMessageWithText:msg forConversation:conversation];
    [smsService sendMessage:ckMsg];
    [ckMsg release];     
} else {
    //4.0
    id ct = CTTelephonyCenterGetDefault();
    void* address = CKSMSAddressCreateWithString(pid); 

    int group = [grp intValue];         

    if (group <= 0) {
        group = CKSMSRecordCreateGroupWithMembers([NSArray arrayWithObject:address]);       
    }

    void *msg_to_send = _CKSMSRecordCreateWithGroupAndAssociation(NULL, address, msg, group, 0);    
    CKSMSRecordSend(ct, msg_to_send);

}

The code uses normal SMS, but you can see the following commented out code:

//CKMadridService *madridService = [CKMadridService sharedMadridService];

The "Madrid" service is probably what can send iMessages. See the private header here.

Both SMS and iMessage private APIs are in the ChatKit.framework.