I just got this working. It's pretty tricky, because you have to get a token for a user in the target org. You can't do this using login.salesforce.com, since you'll likely just get a token for your source org, which won't work.

So... Step 1 - you need to set up 'My Domain' in the target org - Setup | Administration Setup | Company Profile | My Domain. Note that this takes a few hours to take effect. You'll end up with a domain name of the form yourdomain-developer-edition.my.salesforce.com. This is the key to getting org->org OAuth working - you need two distinct domain names.

Step 2. Here is the code for the source org. The target org is unchanged (apart from setting up My Domain):

Controller

/**
 * @author Pat Patterson - ppatterson@salesforce.com
 */

public abstract class OAuthRestController {
    static String clientId = 'YOUR_CLIENT_ID'; // Set this in step 3
    static String clientSecret = 'YOUR_CLIENT_SECRET'; // Set this in step 3
    static String redirectUri = 'https://c.na12.visual.force.com/apex/RestCall'; // YOUR PAGE URL IN THE SOURCE ORG
    static String loginUrl = 'https://yourdomain-developer-edition.my.salesforce.com'; // YOUR MY DOMAIN URL IN THE TARGET ORG
    static String cookieName = 'oauth';

    public PageReference login() {
        // Get a URL for the page without any query params
        String url = ApexPages.currentPage().getUrl().split('\\?')[0];
       
        System.debug('url is '+url);

        String oauth = (ApexPages.currentPage().getCookies().get(cookieName) != null ) ?
            ApexPages.currentPage().getCookies().get(cookieName).getValue() : null;
        if (oauth != null) {
            // TODO - Check for expired token
        }
       
        System.debug('oauth='+oauth);
        if (oauth != null) {
            // All done
            return null;
        }
       
        // If we get here we have no token
        PageReference pageRef;
       
        if (! ApexPages.currentPage().getParameters().containsKey('code')) {
            // Initial step of OAuth - redirect to OAuth service
            System.debug('OAuth Step 1');
       
            String authuri = loginUrl+'/services/oauth2/authorize?'+
                'response_type=code&client_id='+clientId+'&redirect_uri='+redirectUri;
                           
            pageRef = new PageReference(authuri);
        } else {
            // Second step of OAuth - get token from OAuth service
            String code = ApexPages.currentPage().getParameters().get('code');

            System.debug('OAuth Step 2 - code:'+code);
               
            String body = 'grant_type=authorization_code&client_id='+clientId+
                '&redirect_uri='+redirectUri+'&client_secret='+clientSecret+
                '&code='+code;
            System.debug('body is:'+body);
               
            HttpRequest req = new HttpRequest();
            req.setEndpoint(loginUrl+'/services/oauth2/token');
            req.setMethod('POST');
            req.setBody(body);
       
            Http h = new Http();
            HttpResponse res = h.send(req);
   
            String resp = res.getBody();
            System.debug('FINAL RESP IS:'+EncodingUtil.urlDecode(resp, 'UTF-8'));
           
            ApexPages.currentPage().setCookies(new Cookie[]{new Cookie(cookieName,
                res.getBody(), null,-1,false)});
               
            // Come back to this page without the code param
            // This makes things simpler later if you end up doing DML here to
            // save the token somewhere
            pageRef = new PageReference(url);
            pageRef.setRedirect(true);
        }
       
        return pageRef;
    }
   
    public static String getRestTest() {
        String oauth = (ApexPages.currentPage().getCookies().get(cookieName) != null ) ?
            ApexPages.currentPage().getCookies().get(cookieName).getValue() : null;
        JSONObject oauthObj = new JSONObject( new JSONObject.JSONTokener(oauth));
           
        String accessToken = oauthObj.getValue('access_token').str,
               instanceUrl = oauthObj.getValue('instance_url').str;

        HttpRequest req = new HttpRequest();
 
        req.setMethod('GET');
        req.setEndpoint(instanceUrl+'/services/apexrest/superpat/TestRest?name=Pat');
        req.setHeader('Authorization', 'OAuth '+accessToken);

        Http http = new Http();
 
        HTTPResponse res = http.send(req);

        System.debug('BODY: '+res.getBody());
        System.debug('STATUS:'+res.getStatus());
        System.debug('STATUS_CODE:'+res.getStatusCode());
       
        return res.getBody();
    }
}

Page - I called it 'RestCall'

<apex:page controller="OAuthRestController" action="{!login}">
  <h1>Rest Test</h1>
  getRestTest says "{!restTest}"
</apex:page>

Step 3. Create a remote access application (Setup | App Setup | Develop | Remote Access) in the source org with your Visualforce page URL (e.g. https://c.na12.visual.force.com/apex/RestCall) as the callback URL. Edit the controller to set the client ID and client secret values (consumer key and consumer secret in the remote access app page).

Now when you go to the page, you may be prompted to log in (depending on whether or not you have a session in the target org), then you should be prompted to allow the remote access app to access your data. After that, the REST call should take place and you'll see the result :-)

The code is a little horrible, since it puts the whole oauth response in a cookie, but it works :-) A better solution is to generate a random string for the cookie and save the oauth response in a custom object record, indexed by the cookie. You can see how that works in the latest Facebook toolkit code at https://github.com/metadaddy-sfdc/Force.com-Toolkit-for-Facebook - look at FacebookObject.cls.