Not legal, but it happens all the time.
In most states where the DMV doesn't require a bill of sale, all the buyer has to do is take the signed title to the DMV, keep his mouth shut and hope that a past owner hasn't filed a notice of sale to somebody else.
The buyer, of course, takes the risk that the DMV sends him back to the seller or the previous seller for more paperwork, but good luck getting that from anybody who has already got the money.
In our OP's case if he takes the seller to the DMV, hands over the title and they both keep their mouths shut, it's probably going to go through. But if he points to the guy and says "He sold me the car but he's not the owner on the title" the DMV is likely to require the current seller to first title the car in his own name and then retitle it to the buyer.
Some states (I don't know how many, but mine does) have largely eliminated title jumping by requiring the seller to remove and retain his license plates at time of sale. That compels the buyer to get a temporary tag (just to get it out of the driveway) and puts him on record with the DMV so he has no choice but to transfer title to himself in order to drive the vehicle.

