If someone sends a huge number of SMS messages to my phone number will I be billed?

Yes, if Twilio makes a request to your SMS URL then you will be billed. If you are concerned about unexpectedly high message volumes, you can always disable the SMS URL on your phone number (either manually or automatically via the REST API) and Twilio will stop making requests to your application.