I managed to find the data on my Windows laptop, thanks to a suggestion from another poster. By searching for the string "WifiLocation", I was able to identify the SQLite database that contains the data. That DB also has a CellLocation table.
The WifiLocation table has a entry for every MAC address, presumably of the WiFi access point that it found. And there's also a timestamp, latitude, and longitude. The timestamps are bunched, so I'm not sure how accurate it may be.
I already had a script that built a Google map with markers at designated points (by lat/long). I modified that to dump the contents of either the cell or wifi location tables. Both provide a map of where I've been in the past year or so. The cell location map is actually a better representation, although it has fewer data points. I presume it's because the iPhone only logs WiFi access points when it tries to use the WiFi location-assist. By filtering the WiFi datapoints to ones that were only at least 1 mile from the others, I reduced about 15,000 rows to about 400 rows.
Here's the interesting part: it's logging both cell phone tower locations and WiFi locations that are NEAR where I have been, but up to a block or two away (in the case of Wifi) or several miles (in the case of cell towers). I suspect that the iPhone is not recording YOUR location, but is instead recording the known location of the MAC or cell phone tower. Where would it get this? In the past, Apple used Skyhook wireless to derive location from WiFi MAC addresses. I don't know if they still use it.
I suspect that this SQLite database is nothing more than a localized cache, to be used for assisted GPS. When you first launch the Google Maps app, you'll notice it start with an accuracy radius that is about the size of a cell phone tower's footprint. Then the circle gets smaller, as it first uses WiFi to refine the position, and then finally lock on to multiple GPS satellites.
The location of these WiFi access points and cell base stations are in an online database. Apple is probably just storing the location on your phone the first time that you happen to "hear" that particular transmitter, after querying the database over your 'Net connection. Then, the next time your phone needs to use that MAC address or cell station ID to determine your location, it already has it in your local cache.
The WiFi location cache must be seeded with one location: The corner of Berkley Way and Oxford St, on the edge of the UC Berkeley campus. I've never been there, but it's in my WifiLocation table.