Unlike others I don't think that cracking AES is that unlikely - but then I have a rather strict definition of the semantic security of encryption algorithms... The following scenario seems most likely to me (and resembles for example how WEP was cracked).
Note first, that a single cyphertext will produce several valid WPA2 packets when decrypted with different keys. So looking at the stream of cyphertext and directly deducing the information that was sent block by block is impossible.
What is (at the moment only theoretically) possible though, is that with some knowledge of the information that was sent (header information of the WPA protocol for example or the knowledge that a user just opened facebook) you can restrict the possible passwords by looking at the corresponding cyphertexts. (anything that is better than trying every possible password to see whether it results is a packet that might be a part of the facebook page is considered a crack)
You wait until you have enough restrictions, so that you can simply brute-force your way through all remaining possible passwords. The correct password will be the one such that all observed packets "make sense". (having observed enough packets should make a password obtained in this way unique)
From that point onwards you have the password that was used for encryption and you can simply decrypt the cyphertext as it comes along.
Just to emphasize: That there is no "crack" for AES means, that even with the full plaintext information that was sent and the resulting cyphertext you cannot deduce any information about the key that was used. If you can infact deduce anything about the key in such a known-plaintext-attack scenario, you have cracked AES and can apply a scheme as I described above to crack WPA2.