If you look at the assembly (at least for one compiler), you can understand why it works (although this behavior is undefined, as many have pointed out). For these two lines:
test *ptr = NULL; ptr->show();
This assembly is generated (in one compiler I just tried):
00000004: C7 45 FC 00 00 00 mov dword ptr [ebp-4],0 00 0000000B: 8B 4D FC mov ecx,dword ptr [ebp-4] 0000000E: E8 00 00 00 00 call ?show@test @@QAEXXZ
It pushes NULL (0) onto the stack and calls the method, since the address of the method does not depend on the actual instance of the object.
Mark wilkins
source share