It was my impression that he was locating an access point and not the phone. What he is doing is tricking the iPhone into thinking it is located where the victim's AP is because it sees an AP with the victim's MAC address.
I'd question whether or not he has actually tried this. If you read how the skyhook service [http://www.skyhookwireless.com/] works, it says it uses a combination of wi-fi, GPS and cell towers. So in order for it to show you a wrong location based on a single cloned access point you would need to shield the iPhone's GPS, and GSM antennas and then hope the software is naive enough to estimate your location based off one data point.
I'd question whether or not he has actually tried this. If you read how the skyhook service [http://www.skyhookwireless.com/] works, it says it uses a combination of wi-fi, GPS and cell towers. So in order for it to show you a wrong location based on a single cloned access point you would need to shield the iPhone's GPS, and GSM antennas and then hope the software is naive enough to estimate your location based off one data point.