Java Deserialization gadget - Why is this ysoserial payload using reflection to set the TiedMapEntry?

I started studying Java deserialization gadgets. I started with the famous Apache Common Collections gadget and was looking at @matthias_kaiser's gadget chain.

https://github.com/frohoff/ysoserial/blob/master/src/main/java/ysoserial/payloads/CommonsCollections6.java#L65-L100

Could someone please explain the following?

1. Why is the TiedMapEntry set via Java reflection vs just using the HashSet#add() method? For example,

   HashSet hashSet = new HashSet();
   hashSet.add(tiedMapEntry);
   

2. I tried the above and I got a Caused by: java.io.NotSerializableException: java.lang.ProcessImpl exception which is leading me to believe that something might be going wrong during serialization.

3. Is there some way to find out what might be wrong? Any tips on debugging and where to look at?

4. Any ideas on how Matthias might have figured out the reflection "hack" or perhaps his thought process? (I will also try to contact him and others).

If there are additional tips (particularly in debugging), please share because this would help me greatly in understanding this and other vulnerabilities.