You can't simulate M forever on any one input string, because M might never halt on that string. However, you can simulate the i-th string for j moves of M and then abandon that simulation. If you do this for all i and j in the right order, you will eventually discover all strings that M accepts. When you find two of them, you are done. However, you need to explain (among other things) what the right order for pairs i and j is.