If you look at the assembly (for at least one compiler), you can see why it runs (even though it is undefined behavior as many have pointed out). For these two lines:
test *ptr = NULL;
ptr->show();
This assembly is generated (in one compiler I just tried):
00000004: C7 45 FC 00 00 00 mov dword ptr [ebp-4],0
00
0000000B: 8B 4D FC mov ecx,dword ptr [ebp-4]
0000000E: E8 00 00 00 00 call ?show@test@@QAEXXZ
It pushes the NULL (0) on the stack and calls the method since the address of the method is independent of the actual object instance.