I believe (it's been a while since class) that the config register (normally 0x102? something like that)tells the router (bootstrap code/monitor)to boot using BOOTP, once it get's it's config info (IP address, mask, server address), it then does a directed TFPT to get the image.
Since BOOTP is a broadcast-oriented request, any intermediate router must be configured with what Cisco calls "IP Helper." IP Helper converts the broadcast into a unicast aimed at the specified resource (IP Helper by default also passes/converts a bunch of other broadcast-related requests).
I'm a little fuzzy on it, but that's the way I remember it.
FWIW
Scott