I've had some luck with this after more digging around. It must be a terribly unorthodox method though:
This makes my button on the toolbar open the contacts picker which the To button on the compose form normally does. That's just an example of the sort of thing I'm trying to do though, and the same trick doesn't work for other buttons. Just thought I'd post it here for a laugh.
controller = AjxDispatcher.run("GetComposeController");