Using the transponder to track down the plane to tail behind => It’s the same principle by which a cell phone tower can approximate the location of you cell phone. Capture the signal from three points (an antenna array) and it’s just physics and trigonometry to calculate you location.
Listening on departure and center frequencies would get him close, and if he studied this for weeks ahead, he could listen to the center and aircraft transmissions and develop a plan.