You are a bit confused about the nature of addresses in 802.11 frames. Since your question isn't actually about the address fields, let me address that first and then go into the details on the address fields later in my answer if you are interested.
Most devices to which you are referring (whether they are call boosters, repeaters, extenders, etc) don't actually play a part in 802.11 as either a station or part of the distribution system (DS, also most commonly the access point or AP). They are simply devices that listen for and then repeat a signal.
For example, let's say Bob and Bill need to pass a message by radio. Unfortunately, they are too far apart (or maybe there is a mountain range in between) so they cannot reach each other directly. Ben happens to be in the middle (or on the top of the mountain) and since Bob and Bill can't directly talk to each other, Ben offers to repeat their messages so they can communicate.
So when Bob says "Hey, Bill, how are you?" on his radio, Ben hears it and then repeats it back into the air and Bill then gets the message. Any replies from Bill are handled the same way. Ben is not the source, the destination, or the intended receiver of the message. He doesn't really directly play a part in the conversation at all. This is the same process a "booster" will typically use on a 802.11 network.
The way the address fields are used in an 802.11 header is determined by the status of the "To DS" and "From DS" flags.
Address 1 will always be the receiver address (RA) and address 2 will always be the transmitter address (TA). This provides a consistent way for radios to easily determine if they need to receive the frame.
If neither of the "To DS" or "From DS" flags are set, this is a management or "station to station" frame. In these cases, address 1 is is the destination address (DA) in addition to the RA. Address 2 is the source address (SA) in addition to the TA. Address 3 would contain the BSSID (so radios not in the BSS can filter it) or be set to broadcast (all F's). Address 4 is unused.
If only the "To DS" flag is set, this is a frame bound from a station to a DS. In this case, address 1 is both the RA and the BSSID, address 2 will be both the TA and the SA, and address 3 will be the DA. This makes sense as while the station needs to send the frame to the DS, it is actually destined for some other host on the network and not for the DS.
If only the "From DS" flag is set, this would be a frame from the DS (or AP) to a station. Address 1 will be both the RA and the DA, address 2 will be both the TA and BSSID, and address 3 will be the SA. Again this makes sense as while the DS is transmitting the frame, it was sourced from another device on the network.
If both the "To DS" and "From DS" flags are set, this would be frames sent from one DS to another DS, such as you would find when using wireless access points to bridge traffic for other devices. Address 1 will only be the RA, address 2 will only be the TA, address 3 will only be the DA and address 4 will only be the SA.
You obviously don't know the AP's MAC address, so you want to send it to everybody. You use the broadcast address FF:FF:FF:FF:FF:FF. Every device will receive this packet, and APs will respond with a probe response.
Listening for beacons is not enough. Often, SSID's are hidden, so you have to actively probe for them.
Best Answer
The distinction to understand is that while an 802.11 device is transmitting to a receiving device, either one (or both) of these devices may not be the actual source or destination of the L2 traffic. So this can create situations where you need four different distinct addresses:
The BSSID of the wireless network may be the TA or RA, but it can also may be an identifier to associate traffic to a BSS. Unless the access point (AP) uses the same MAC address for the management interface and the BSSID, you generally won't have any traffic where the BSSID is either the SA or DA.
The use the address fields in an 802.11 header is tied to the To/From DS (distribution system) flags. Depending on how the To/From DS flags are set, this determines which of the four fields are required and what information each provides.
Here are a couple quick summary tables that I took from an IEEE document:
Let me add a couple of images to provide examples take from 802.11 Wireless Networks: The Definitive Guide by O'Reilly Press: