Does the "Find my iPad" service work without WiFi when you aren't paying for cellular service? If I'm not paying for cellular service on my 4G iPad, and it's not in range of a WiFi network it knows about (or is open), then will the Find My iPad service still work through the cellular network? I notice that I can sign up for service without being in a WiFi area when I haven't already purchased service, and it still tracks what type of cellular network I'm attached to and the signal strength when I'm not paying for cellular service.

It would be nice if Apple and the carriers threw in Find My iPad for free so that even if I lose it (or it's stolen) in a month I'm not paying for service then I can still find it.

Unfortunately, I already activated my service recently, so I have to wait another few weeks before I can test it.
No, you can get an app like NetStat and see the ports that open when WiFi is connected as well as when data is available, but not connected.

The carriers would know where it was since their cell towers would have a fix on the IMEI (or equivalent for non GSM carriers) - but that database isn't integrated into the Find My Phone service in any way we can see.

You are correct that the hardware talks with base stations that are near by and it would be nice (kind of like 911 service is permitted even when a line is inactive) for consumers to have this work without respect to billing status.