The SSID will pop up as soon as a client starts to communicate with the AP.. It's right there in the communication between the client and the AP.. Same goes for the MAC address.. Most modern NICs will allow you to change the assigned MAC.. So you change your MAC to one you've picked up during a scan and hey presto....

Oh.. And to elaborate on the hijack issue... WinXP (probably others too) seems to remember the SSID of the last AP it connected to. When it isn't connected it'll keep calling for that same SSID.. I can pick up these probes, read the SSID your client is broadcasting, configure my AP to use that SSID and you are suddenly connected to my AP