From what i remember it has something to do with the TOC pointing to the track index at a point Past the actual start of the CD. My brother had a symphony soundtrack cd of FFVII in which it had a secret track of "One Winged Angel" battle music before track one.
When we used Cdrwin we noticed that the first track seemed to start past sector 0 of the drive. So we set it to rip in raw mode and stripped the unknown area into a wave file. And it worked.
In short it just relies on Illegal Table of Contents.
If anyone remembers the Xfiles soundtrack cd supposedly had alot of little tricks like this. But i never actually saw it.
Unfortunately using this technique it makes it impossible for alot of cd players to read the secret tracks. Most notably alot of car stereo ones will have problems. As well as most newer players. The only reason we were able to manually play it on the computer was my "hacking" the raw data out of the cd and then playing it.