So once you enable "hidden" API features (if using Android Studio, use this guide) of Android and have downloaded the SDK source you can do the following:

import android.net.wifi.WifiSsid;

The cool thing is you don't need to use reflection to access this hidden variable contained in the ScanResult class. This is because it is actually public within that class and it is no longer "hidden" as it is built into the compiled class file that has been extracted from the emulator (@hide removes it from here on the compiled libraries in the SDK). I had to use the 4.X SDK to do this as the SDK manager didn't allow easy download of the 2.X source, but I aim to get it working on either.

So all we need to do now to get this byte array is:

WifiSsid result;
byte wifichar[];
...
if (wifiScanList.get(i).SSID.toString().startsWith("SPS:")) {
    result = wifiScanList.get(i).wifiSsid;
    wifichar = result.getOctets();
}

And here we have it:

The plan is to eventually create an Android service application that can integrate with existing location services. You could also filter out SSIDs with the SPS tag for a cleaner Android Wi-Fi UI (Windows already doesn't show values past a null character, so the SSID shows as "SPS" if you change the tag to SPS\x00).

Now I'm just waiting to receive a few more ESP8266 modules to implement the position triangulation (I want to test this first with identical modules rather than starting to normalise different AP signals with the TX power data).