An UE can reach to visited network through following two procedures:
1. Switch on at visited network.
2. Handover to visited network.
When UE switches on at visited network, it sends attach request message to visited network's MME.
After receiving attach request message, MME contacts to UE's home network PLMN and proceed further to complete attach procedure.
Similarly for handover procedure, when due to UE mobility and home network coverage, UE gets handed over to visited network. Traffic is still routed through home PGW and visited network SGW.