I was curious how this worked so I did some reading which I found interesting. In short, this uses ptrace, which is the same Linux kernel mechanism used by debuggers, to attach to a running process and manipulate the open file descriptors (amongst other things) while it runs. So basically it attaches to the process, and changes stdin (fd 0) and stdout (fd 1) to point to your tmux session stdout and stdin.
This is pretty cool! I had done something similar to connect isolated processes on the fly last year. But never thought to do that with tmux as a target.
Pretty cool use of ptrace.