With the help of Growl's documentation about AppleScript support and a little discussion with Bart Arondson and Elliot B in the comments onto the question I've come up with the following AppleScript.

I've saved this script as an application agent which you can add to your login items in System Preferences → Users & Groups → Login Items.

Basically, this application works by detecting if a unique executable related to using the camera is being accessed. Whenever the executable is accessed, the application will notify about it to Growl:

Download

It's important to know that this script monitors access to the executable...

/System/Library/Frameworks/CoreMediaIO.framework/Versions/A/Resources/VDC.plugin/Contents/MacOS/VDC

Full script

-- check if growl is running in order to avoid the "Choose Application" dialog
tell application "System Events"
    set isRunning to (count of (every process whose bundle identifier is "com.Growl.GrowlHelperApp")) > 0
end tell

-- store time of last iSight access
global lastopened
set lastopened to do shell script "ls -lu /System/Library/Frameworks/CoreMediaIO.framework/Versions/A/Resources/VDC.plugin/Contents/MacOS/VDC | awk '{print $6,$7,$8}'"

-- make the application ready for use with growl
if isRunning then
    tell application id "com.Growl.GrowlHelperApp"

        -- make a list of all the notification types that this script will ever send
        set the allNotificationsList to ¬
            {"iSight access monitor"}

        -- register the script with growl
        register as application ¬
            "iSight access monitor" all notifications allNotificationsList ¬
            default notifications allNotificationsList ¬
            icon of application "FaceTime"

        -- send the first notification right after the application is started
        notify with name ¬
            "iSight access monitor" title ¬
            "iSight access monitor" description ¬
            "last iSight access: 
" & lastopened application name "iSight access monitor"
    end tell
end if

-- monitoring routine: checks every 10s if the VDC executable has been accessed
on idle
    tell application id "com.Growl.GrowlHelperApp"
        set newopen to do shell script "ls -lu /System/Library/Frameworks/CoreMediaIO.framework/Versions/A/Resources/VDC.plugin/Contents/MacOS/VDC | awk '{print $6,$7,$8}'"
        if (newopen is not equal to lastopened) then
            notify with name ¬
                "iSight access monitor" title ¬
                "iSight access monitor" description ¬
                "new iSight access: 
" & newopen application name "iSight access monitor"
            set lastopened to newopen
        end if
    end tell
    return 10 -- interval in seconds
end idle

OS X actually has (at least) 3 firewalls. Since you've turned off the application firewall (in System Preferences -> Security & Privacy -> Firewall) and checked the Berkeley packet filter (pfctl -sa), I'm guessing it's the old ipfw that's doing the blocking. You can check with sudo ipfw show -- that'll list the active rules, along with counts of how many packets and bytes each one has applied to:

$ sudo ipfw show
01000 19228642 23229993542 allow ip from any to any via lo0
01010        0           0 deny ip from any to 127.0.0.0/8
[etc...]
65534    23505     3467352 deny ip from any to any
65535        0           0 allow ip from any to any

If your listing only shows rule #65535 (the allow rule at the end), my guess is wrong and you have to look elsewhere. If it does show other rules, you probably have a third-party firewall config program installed somewhere (I don't think the Apple-supplied ipfw config software is still there in 10.8); take a look in /Library/StartupItems and /Library/LaunchDaemons for things that might be relevant.