CPMs/DEMs are legal (meaning licensed and regulated) in 24 states: AK, AR, AZ, CA, CO, DE, FL, LA, MN, MT, NH, NJ, NM, NY, OR, RI, SC, TN, TX, UT, VT, VA, WA and WI (though WI's law doesn't take effect until May 2007). In DE, NY and RI administrative agencies either refuse to issue licenses/permits to DEMs or require them to attain essentially the same training and credentialing as CNMs.
As other posters have noted, there are no laws in any state prohibiting home birth or VBAC, although in many of the states listed above, licensed midwives are either prohibited from attending HBACs or they must adhere to certain restrictions for attending HBACs. I think your friend's best bet is to narrow her options down to the above states (except for DE, which refuses to issue licenses/permits to DEMs even though the law allows for it) and then go to the state's legislative website to read the midwifery VBAC regulations for herself to make sure they haven't recently changed.
I know a number of posters have mentioned "unregulated" states, but if your friend only wants to work with a midwife who's following the letter of the law, then she should stick to the states listed above. CPMs/DEMs in all other states are subject to criminal prosecution under a range of statutes, including the medical/nurse/nurse midwifery practice acts (which all midwives in those states are violating) and laws on carrying controlled substances (i.e. Pit or Methergine).
In the case of PPH or a baby's injury or death, CPMs/DEMs in the remaining states are subject to prosecution via statutes covering the unauthorized use of controlled substances, manslaughter or child endangerment. In all of these states, CPMs/DEMs are in fact regulated, but via criminal statutes that, due to the lack of laws defining the practice of midwifery and exempting it from the statutes governing medicine/nursing and authorizing midwives to administer medications, effectively make CPMs/DEMs illegal.
Wisconsin Guild of Midwives