Arduino Bootloader Details
void (*app_start)(void) = 0x0000; 


This isn't a NULL pointer. This really is the address of the start of application code, which the bootloader jumps to. The linker arranges for your application code to start at address 0. See table 26-6 in the ATMEGA168 datasheet.

The bootloader code starts higher up in flash. Exactly where depends on the bootloader fuses.