My approach to this was to use an OpenWRT (could be done with DDwrt or other similar projects) device (a TPlink 3600) and to use only tcpdump and monitor mode (not airodump). Using TCPdump lets you see all traffic (to profile area activity as well as watching for beacons/probes) The advantage to using a dedicated device is they are inexpensive, use little electricity, and have two radios that work independently. I used a flash drive mounted on /media/drive1 to hold the files. The below commands will watch channel 11 on the b/g/n bands and channel 149 on the a/n bands, obviously this can be changed to suit local needs. With this running at startup you can move the device to the desired area, plug it in, wait, and then unplug it and review the files from the flash drive on your PC. The possible wireless security audit scenarios with this platform are many.
Also, as a point of clarification to your original thesis that "phones broadcast the SSIDs of all networks they have ever connected to" this is a bit oversimplified: devices will send probes for any network currently in their wi-fi configuration, which for most users are all the networks they have signed on to in the past but you can easily remove unused entries from this list to reduce the information leaked by your device. An option like "only associate to broadcasted SSIDs, do not probe" would be desirable but alas this is really a low priority when it comes to security, compared to other issues on most mobile devices.
/usr/sbin/iw phy phy0 interface add mon0 type monitor;
/sbin/ifconfig mon0 up;
/usr/sbin/iw mon0 set channel 11;
/usr/sbin/iw phy phy1 interface add mon1 type monitor;
/sbin/ifconfig mon1 up;
/usr/sbin/iw mon1 set channel 149;
echo "starting with $capdir" >> /tmp/capstartup
/usr/sbin/tcpdump -i mon0 -C 50 -w $capdir/mon0.pcap &> /tmp/error.myprog0 &
/usr/sbin/tcpdump -i mon1 -C 50 -w $capdir/mon1.pcap &> /tmp/error.myprog1 &