A client that's actively looking for networks to join will occasionally broadcast a probe request frame on all of the channels it can transmit on, trying to get nearby access points to respond. If you have at least three access points that "hear" the same probe request and you know where those access points are located, you can use the position information of the access points combined with the received signal strength of the probe request frame at each access point to compute that client's position.