How do "Pay to Script Hash" transactions work?
You're correct so far, you just stopped before you were finished. As BIP16 says, it "defines additional validation rules that apply only to the new transactions" -- specifically, "{serialized script} is popped off the initial stack, and the transaction is validated again using the popped stack and the deserialized script as the scriptPubKey."

So:

1) The script is popped off the stack, leaving only [signature] on the stack.

2) The deserialized script is added, leaving [signature] [pubkey] OP_CHECKSIG.

2) The transaction is validated again, that is, a normal signature verification occurs against the specified public key.