In the source code of SIMBL Agent, there're several codes which send Apple events to the target application. It's like:
[app setSendMode:kAEWaitReply | kAENeverInteract | kAEDontRecord];
id initReply = [app sendEvent:kASAppleScriptSuite id:kGetAEUT parameters:0];
and
[app setSendMode:kAENoReply | kAENeverInteract | kAEDontRecord];
id injectReply = [app sendEvent:'SIMe' id:eventID parameters:0];
I've no idea why the target app will load up the SIMBL plugins after this trigger. It seems to be a very hacky way to do so, and It's difficult to get help from the official documents.