A fairly simple process. The pref pane is inside the app wrapper as a resource (the code isn't really run directly by the app so I believe this should be fine). The pref pane is copied to a temp location, the quarantine flag stripped (make sure to do it recursively), and then handed off to SysPrefs to open.

Feel free to email me if you need more details.