Preferred access list (WPA2 rogue AP)

Question

For the following scenario in which victim has a WIFI access point at home (AP-HOME) through which he surfs the net and a client (CLI1) connected to "AP-HOME" via WPA2. The victim also has "FREE-AP" in his list over preferred WIFI networks. "FREE-AP" has no encryption.

The evil hacker has a battery driven mobile rogue access point set up to use either ESSID "AP-HOME" or "FREE-AP" depending on conditions below in questions. Also the rogue AP has a high gain antenna attached and no encryption.

I have Following Questions:

1. Will CLI1 connect to the hackers rogue FREE-AP instead of victims legitimate access point AP-HOME if the evil hackers rogue access point is hidden close to the CLI1 (but still outside the house)? Or will AP-HOME always be chosen since it is number one in CLI1 preferred list for WIFI connections?
2. Will a denial of service-attack against the victims AP-HOME disconnect CLI1 from AP-HOME and then choose number two in the list over preferred connections instead, hence connecting to evil hackers rogue ap FREE-AP?
3. If CLI1 is say at work and already connected to a LAN via cable but also has the WIFI turned on. What would happen if evil hacker comes along with the rogue access point with ESSID "AP-HOME". Will CLI1 connect to that as well or do nothing since it is connected (to internet) already? I know windows will use the network connection with lowest metric value but will CLI1 still be a part of the network that the rogue access points is offering (meaning CLI1 will be possible to attack via WIFI interface)?
4. Any ideas on how to get CLI1 to download an exe? The best idea so far is to fake a page looking like http://www.update.microsoft.com/ and try to trick the user into downloading and run a VERY IMPORTANT UPDATE

Answer 1

1. Yes, We can create FAKE AP but with same ESSID or BSSID as legitimate one. Thus if our signal strength is higher victim will connect to FAKE AP. For ex We can duplicate the AP-HOME and with same MAC address that AP-HOME has.

2. If AP-HOME is off, and we create fake AP with ESSID AP-HOME, client will automatically connect to us.

3. we can set up wifi bridge between authorized network and Rougue-AP, and in this case if Victim connects to Rougue-AP he will have access to internet via Wifi-Bridge.

4. Well, the simplest way but the most hardest trick is to show victim a webpage which will automatically download a virus on client's PC. Ever visited a malicious site that automatically delivered virus on your machine. This way client will no necessarily download virus but will get infected.

Some things in question were unclear, I hope this will help