Thanks for the responses. To answer the second one first, this is a typo on my part; I did indeed mean "*", and that is what didn't work.
I'm not sure how to interpret shell:::{35786D3C-B075-49b9-88DD-029876E11C01} but I have tried using Shell interfaces (I rejected the WPD API as too complex and poorly explained), by interating down from "Computer" until I find a drive with the display name "Apple iPhone" (is there a cleaner way?). This is promising so far, in that I am able to drill down through the subdirectories on the phone; however, I haven't yet got as far as trying to read individual files, and the lack of good sample code makes it a slow process. Currently I'm using BindToObject to get the subfolder's IShellInterface, but I wonder whether I should be using the IStorageInterface, members OpenStream and/or OpenStorage; clearly I will have to use something like that to read individual files.
While experimenting with this, I did notice something strange in Windows Explorer. First of all, the context menu on (for example) a JPG image on the iPhone is different from that on a similar file elsewhere, both in contents (no "open with", for example) and format (closer spaced and without the "cut", "copy" etc buttons at top or bottom). Secondly, if I right-click a file on the iPhone and select "Properties", the location is shown as (for example) This PC\Apple iPhone\Internal Storage\200503__ (which is how it appears in Explorer), but if I open it in its default application (which in my case is Irfanview), its folder is shown as C:\Users<name>\AppData\Local\Microsoft\Windows\INetCache<random string>\ which suggests the Windows has for some reason made a copy in the background.