DC from AC line without completing circuit?

I think you'd have to look inside them. Some of them use a Siemens chip called LightwaveRF that might include some magic, but you can also do some properly hack stuff using capacitors if you only need a small amount of power from the mains.

As they're radio based, what about intercepting the radio signal? Could you just have a totally separate board somewhere that detects when the 'on' command was sent, and that then sends an 'off' command after a timeout?