Objective-C Runtime Reference
It's easy to forget that the syntactic sugar of Objective-C is converted to normal C function calls that are the Object-C Runtime. It's likely that you will never need to actually delve into and use anything in the runtime. That is why I would consider this a 'hidden feature'.
Let me give a way one might use the runtime system.
Let's say that someone is designing an external framework API that will be used by third parties. And that someone designs a class in the framework that abstractly represents a packet of data, we'll call it MLAbstractDataPacket. Now it's up to the application who is linking in the framework to subclass MLAbstractDataPacket and define the subclass data packets. Every subclass must override the method +(BOOL)isMyKindOfDataPacket:(NSData *)data.
With that information in mind...
It would be nice if MLAbstractDataPacket provided a convenience method that returned the correct initialized class for a packet of data that comes in the form +(id)initWithDataPacket:(NSData *)data.
There's only one problem here. The superclass doesn't know about any of its subclasses. So here you could use the runtime method objc_getClassList() along with objc_getSuperclass() to find the classes that are subclasses of MLAbstractDataPacket. Once you have a list of subclasses you can then try +isMyKindOfDataPacket: on each until one is found or not found.
The reference information about this can be found at http://developer.apple.com/documentation/Cocoa/Reference/ObjCRuntimeRef/Reference/reference.html.