http://www.psx-scene.com/forums/444492-post14.html
This method worked when my GS2 v4 didn't. Admittedly, the GS2 disk in question had been beaten to hell, and there were no GS2v4 images that weren't DVDs (so swaps were out of the question - the pressed disk has to have a larger TOC than the backup, and no CD can hope to produce a 1.4GB TOC...). This method does have a non-zero chance of damaging your PS2, cosmetically or otherwise - if your PS2's drive motor is marginal you may want to find some other way, and I'd be careful about using disks I'd actually want to keep after finishing the exploit if I were you. I managed to break my drive's faceplate, in part because it's a few years old, and I only poorly understood the removal method, having done it to my deceased V7 a *long* time ago. But my PS2 is still alive (yes, the laser and drive motor's fine, too), and I didn't have to spend more than US$75 (PS2 and network adapter, everything else came from my V7 and a dead PC), so I don't mind all that much.
I used:
Sony DVD+R (and some random DVD+RW, which didn't work... :/) + uLaunchELF injected into the DVD (I injected it into the NFS Carbon demo)
US NTSC V6 PS2 + Network Adapter + Seagate 60GB
Generic SD reader + Transcend 4GB SD, with the FMCB noobie package written to the root directory
Random plastic gift cards for my slide tool (use a pattern!)
and most importantly - a NTSC-U/C PS Underground 110 disk.
Demo disks are usually worthless, but for our purposes they're actually pretty awesome, as it's easy to tell which ELF corresponds to which menu entry, and they have predictable behavior, so you *know* when the time to swap is right.
Make sure to play around with the unaltered disk a bit so you know when the point of no return (execution of the demo/network setup ELF) is reached. On my disk, it was the menu that displays the controls for the game demo that I'd injected my code into. Once I got the hang of the swap method, I popped the latch (look on Youtube so you can get an idea of what needs doing, and PRACTICE with the machine off some!), quickly swap the disks, push the tray in, fumble a bit with the slide card (but be quick - you only have a few seconds, usually 5-10, before it'll attempt to reauthenticate the disk, and if it tries, you're screwed and have to start over), relatch the drive, and hit X to boot (or whatever it wants). You'll be in uLaunchELF, and can use the file browser to find the FMCB installer and launch it. I managed to go from a vanilla PS2 to fully exploited and ripping FFX-2 for my little sister in 45 minutes, and that's *including* a few false starts and showing the method to her.
By the way, don't inject the FMCB installer directly just so you can skip using mass storage. Having an emergency boot method for arbitrary ELFs is more handy than simply having an exploit installer that may be outdated by the time you need to use it.