I haven't tried the variac, but that should work. The reason that the real testing labs use a specific pulse generator is they're also testing the response time of the TVS. To just determine if the TVS is working (somewhat), that would be sufficient.
Although the predominant failure mode is shorted, they can also fail open. A TVS can also slowly degrade over time and not meet it's specifications. That's a lot harder to accurately test for without more sophisticated test methods.
