Smoke detector position vs air register

Ionization smoke detectors use a radioisotope to generate a very small electrical current, which when interrupted causes an alarm to sound. These types of alarms use a metal–oxide–semiconductor field-effect transistor (MOSFET) to prevent the alarm from sounding, as long as the tiny current is flowing from the detector.

A simple dumbed down version of the circuit, might look something like this.

Notice the 9V battery is connected to the Source contact of the MOSFET, the detector is connected to the Gate, and the Alarm is connected to the Drain. This means that as long as there is a current on the gate, current will not flow from the source to the drain. If something (smoke) interrupts the current flow to the gate, current will flow from the source to the drain and the alarm will sound.

If you add a normally closed switch to the circuit, like so.

Opening the switch will prevent current from flowing to the gate, simulating a loss of current flow from the detector. Which in turn, will cause the alarm to trigger.

So when you press the test button on an ionization type smoke detector, you're not actually testing the circuits ability to detect smoke. Rather, you're testing the circuits ability to react to a loss of current flow to the gate contact of the MOSFET. You're also making sure the battery is not dead, and has enough juice left to sound the alarm if need be.

I've seen them triggered by steam, dust, and aerosols (hairspray).

Basically, they are succeptible to small, airborne particles. Most smoke detectors activate when the particles of smoke (or other substances) "block" the detector (which is usually either alpha radiation based or optical).