I'm pretty sure it's a legal requirement that mobile phones should allow people to dial the emergency services (in the UK 112 and 999) without needing to find out how to unlock the keyboard.

But that doesn't rule out the idea that only the specific sequence 9-9-9-call needs to work, whereas sitting on the keypad and generating 4-6-3-4-6-9-3-4-5-9-4-2-3-5-9-2-0-call could usefully say "stop being silly".

Yes, but laws (and the interpretations of laws) rarely take silly into account. Either that or they're just being lazy; I think, however, that they're mostly just covering their arses to avoid a lawsuit from someone trying to dial 999 whilst wearing boxing gloves.

or a timeout? leave the first 9 on the screen for X seconds and then give up and go back to a clear screen

A quick test suggests that mine only reacts to any substring being 9-9-9 (so 9-7-9-9 won't do).