Wireless – Does WiFi Router/AP change the working channel automatically during the normal use

What happens is that your wireless device, even when tuned for channel 6 (2437) also have a small probability to receive frames from neighboring channels, such as channel 5 and 7. and even further (with less probability).

This is highly dependent on the wireless interface that you use. The worst radio that I found was an AR9170 based USB adapter, which was able to pick traffic on channel 1 when turned for channel 6. Some other interfaces (e.g. AR9280) do not have this problem, or it is fairly reduced.

PS: AR9271 is not supported by the ath9k driver, but by the ath9k_htc driver. Because this card seems to be the natural successor to AR9170, I am not surprised that you experience the same issue.

The short answer is yes, it is not only possible, but happens all the time. Examples of this are CTS-to-self, beacons (sent by APs), probe requests, probe responses and a number of other management types of frames.

However, it seems that isn't exactly what you mean and are looking for a way to transmit data from one device to another without any sort of established relationship. The only software I know of that transmits data in this fashion are tools used when penetration testing wireless security.

Generally, these work by replaying data captures back into the air. Instead of replaying captured traffic, you could craft your own 802.11 frames into a "capture" file and replay any data you wanted. Your second station in monitor mode could then capture the traffic out of the air.

Do keep in mind that this would be a very rudimentary form of wireless communication and does not provide any mechanism for retries/retransmissions (recovery from collisions or other interference) or a means of encryption (unless you encrypt the data before creating your frames).