I'm unclear -- does the victim have to actively connect to a malicious network, or does work even if the victim is unconnected/connected to another network?
This implies that the exploit can happen when the phone is just scanning for list of available networks.
From reading the actual Project Zero post yesterday, the exploit was figured out using the fast BSS transition which I think is for high frequency p2p transmission, i.e. sending a video to your Chromecast. So you still have to be connected to the same network.
https://googleprojectzero.blogspot.com.au/2017/04/over-air-e...