I had no idea that the WPS specification included two PIN number options (client->AP which is this attack and AP->client) - thought it only worked when you pressed the physical button.