Inside, a GFCI passes both (or all) circuit conductors through a ring with a small coil on it. As long as all current on the hot returns on the neutral, no magnetism is generated in the ring, and no voltage is generated in the little coil.
If someone gets a shock, then some current returns to the source through the person, whatever grounded surface they happen to be in contact with, through the electrodes, and back to the source grounded conductor.
When that happens, the difference in current causes a voltage in the little coil, which triggers the GFCI to trip. It doesn't matter how many hots there are, as long as all of them, along with the neutral if there is one, pass through the ring.
That's why a GFCI requires that the system on which it's used has a grounded conductor. A shock (or equivalent leakage to earth or other grounded surface) has to occur for a GFCI to react.