Question

Is it correct that a instance method can be called on a null reference in IL..?
Is there any example to show this..?

Answer 1

Yes, this is possible, as long as the method doesn’t use this because the CLR does not do a null check for call instructions.

You would have to modify the IL by hand as the C# compiler would almost always generate a callvirt instruction¹.

See this blog post for details and an example:

Instance Methods Called on null References

Sample

.method private hidebysig static void  Main(string[] args) cil managed
{
    .entrypoint
    // Code size       18 (0x12)
    .maxstack  1
    .locals init ([0] class SomeClass o, [1] string hello)
    IL_0000:  nop
    IL_0001:  ldnull
    IL_0002:  stloc.0
    IL_0003:  ldloc.0
    IL_0004:  call       instance string SomeClass::GetHello()
    IL_0009:  stloc.1
    IL_000a:  ldloc.1
    IL_000b:  call       void [mscorlib]System.Console::WriteLine(string)
    IL_0010:  nop
    IL_0011:  ret
} 

¹In fact the reason that the C# compiler emits callvirt even in cases where a simple call instruction would be sufficient is to prevent calling instance methods on null references. With this behavior of the compiler users will get a NullReferenceException so the weird situation of calling a method on a null pointer is avoided. Eric Gunnerson explained this in a blog post some time ago: Why does C# always use callvirt? Gishu also has a nice explanation in a related question.