/mcpUtilize VRF binding to ensure the correct inbound dial-peer is matched, and Dial-peer Groups to ensure the correct VRF bound outbound dial-peer is matched. If a SIP packet for a call to 8675309 arrives on gig0/0/1.2, then the gateway filters out all available inbound dial-peers based on the VRF2 ID. This means you cannot match dial-peer 10. Now when you check the digit-string, you can match dial-peer 20. Dial-peer 20 has a dial-peer group which tells the gateway the only outbound dial-peer that can be matched is also dial-peer 20. This dial-peer group allows you to avoid matching dial-peer 10 and crossing a call coming from VRF1 into VRF2. From there the call can proceed as normal.
! interface GigabitEthernet0/0/1.1 description VRF1