What about setting up a WEP access point to impersonate the WPA one, then getting the password from that? Still seems more likely to work than what it's doing now.

You'd still need the Pre-Shared key to create a legitemate looking access point, so it is kind of a catch-22.

WPA/WPA2 as a system is actually not that bad (for home use).

Why? If WEP is vulnerable, then if victim connects to a WEP fake and enters their password, we should be able to read that. Like a downgrade attack.

Would this work against WEP? Or is the standard capture and crack better?

You can attack WEP with active attack that defeats the encryption in a matter of seconds. The only thing you need to remember about WEP is just don't use it.