Pay to Script Hash Execution
I've been hunting for this information myself, and had to dig to the bitcoin source code to find the answer - couldn't find it anywhere else.

There is a hardcoded logic in bitcoin for P2SH validation:

The stack is backed up between the steps 2 and 3 (generally - between scriptSig and scriptPubKey execution).

After both scripts are executed and verified, the stack is restored from the earlier backup, the redeem script is popped from the stack, deserialized, executed and verified. This is done by internal bitcoin code, not by any script.

Corresponding source code:
https://github.com/bitcoin/bitcoin/blob/6fef85bfa3cd7f76e83b8b57f9e4acd63eb664ec/src/script/interpreter.cpp

Stack is backed up at 1493, and restored at 1529, where all the magic begins.