We do come across this particular and one of the most common exception in our coding/development life day or another day. My Question is NOT about W
The MS implementation, IIRC, does this via an access violation. Null is essentially a zero reference, and basically: they deliberately reserve that address space and leave this page unmapped. The memory access violation is raised at the CPU/OS level automatically (i.e. without needing extra code to do a null check), and the CLI then reports this as a null-reference exception.
Interestingly, because memory is handled in pages, you can actually simulate (if you try hard enough) a null-reference exception on a non-zero but low value, for the same reasons.
Edit: Eric Lippert discusses this on this related question/answer: https://stackoverflow.com/a/8681563