Except the attack doesn't get you access to their wireless network. It allows you to redirect someone from their wireless network to your own (spoofed) wireless network and then you can snoop the traffic.

If it works in one way what reason is there to think it won't work the opposite direction? This flaw is in the protocol itself.

You're freaking me out with that scenario