I am aware that clients can send probe requests to find hidden SSID APs. Also, I've seen that clients can send probe-any requests with NULL SSID lists, to see all APs within range.
However, can APs send probe requests(or something similar) to reveal clients? If so, could this also reveal clients who are not connected to that AP?