Blackberries should only browse the internet via its enterprise server. Under special circumstances you can fore it to use a hotspot which is controlled by an attacker. Blackberries remember their communication path to speedup communication. So if websites are requested once over the rogue wireless network, it will insist to use this communication channel for that specific page.