We consider the following interleaved runs of the protocol:

$A\longrightarrow C(B):\qquad A,N_{A}.$
$1^{\prime}.\qquad C(B)\longrightarrow A:\qquad B,N_{A}.$
$2^{\prime}.\qquad A\longrightarrow C(B):\qquad\{N_{A},K^{\prime}_{AB}\}_{K_{AB}}.$
$C(B)\longrightarrow A:\qquad\{N_{A},K^{\prime}_{AB}\}_{K_{AB}}.$
$A\longrightarrow C(B):\qquad\{N_{A}\}_{K^{\prime}_{AB}}.$
$C$ cannot encrypt $A$ :s nonce, so he needs to get help with message 2. He therefore starts a new run with $A$ , letting $A$ do the encryption and reflecting the reply back. $A$ will accept the unprimed protocol run and believe that $B$ is present. (Of course, $C$ does not learn the session key, but that is another story.)