Update: Got my Android dev phone, and the SIM card from the prepaid T-Mobile phone works fine (note that several people below pointed out that Sprint is using CDMA, so it will NOT work with that carrier).

Caveat: the phone is set up to require a data plan for activation, which you don't get with the prepaid T-Mobile plans. Fortunately, there's a way around that. :-) (note my comment on replacing the single quotes with the proper characters).

After tweaking the database, setting up the phone to talk to my WiFi network, and plugging in the SIM from the cheap phone, everything seems to be working fine. Obviously I haven't tried everything yet, but I can browse the web, make calls, etc.

It looks like they have several models which use SIM cards. For example, this one.

PS. Every single prepaid phone that walmart sells uses CDMA as well, no SIM cards there either.

The one I have was definitely purchased at Walmart, definitely is a T-Mobile unit, and definitely has a SIM card.

Couldn't you just buy an Android dev phone now and swap the SIM out of your Sprint phone?

More money up front, of course, but no contract obligation and you have root access to the phone.

Disclaimer: I haven't received my dev phone yet (it's supposed to arrive today!), so I'm not certain this will work. I'm planning to toss in the SIM card out of a Walmart Special prepaid phone I have hanging around, but that's a T-Mobile unit.

You're ignoring the scenario where the person who gets pwned has access rights to your sensitive information (bank, school, government agency, employer).