𝗥𝗲𝗮𝘀𝗼𝗻 𝟭: Because of the table specified in ECMA-262.
𝗥𝗲𝗮𝘀𝗼𝗻 𝟮: It might be a bug

Let's understand this:

In the 𝗶𝗻𝗶𝘁𝗶𝗮𝗹 𝗶𝗺𝗽𝗹𝗲𝗺𝗲𝗻𝘁𝗮𝘁𝗶𝗼𝗻 𝗼𝗳 𝗝𝗮𝘃𝗮𝗦𝗰𝗿𝗶𝗽𝘁 all values were stored in 𝟯𝟮 𝗯𝗶𝘁𝘀 𝘂𝗻𝗶𝘁𝘀, where:
The 𝗳𝗶𝗿𝘀𝘁 𝟭–𝟯 𝗯𝗶𝘁𝘀 contain the 𝘁𝘆𝗽𝗲 𝘁𝗮𝗴
The 𝗿𝗲𝗺𝗮𝗶𝗻𝗶𝗻𝗴 𝗯𝗶𝘁𝘀 contained the 𝗮𝗰𝘁𝘂𝗮𝗹 𝗱𝗮𝘁𝗮

The 𝘁𝘆𝗽𝗲 𝘁𝗮𝗴 for 𝗼𝗯𝗷𝗲𝗰𝘁𝘀 was 𝟬.

The 𝗻𝘂𝗹𝗹 𝘃𝗮𝗹𝘂𝗲, however, was 𝗿𝗲𝗽𝗿𝗲𝘀𝗲𝗻𝘁𝗲𝗱 as the 𝗡𝗨𝗟𝗟 pointer, 𝘄𝗵𝗶𝗰𝗵 𝘄𝗮𝘀 𝟬𝘅𝟬𝟬 for most platforms. As a result of this 𝘀𝗶𝗺𝗶𝗹𝗮𝗿𝗶𝘁𝘆, 𝗻𝘂𝗹𝗹 𝗵𝗮𝘀 the 𝟬 𝘁𝘆𝗽𝗲 𝘁𝗮𝗴, 𝘄𝗵𝗶𝗰𝗵 corresponds 𝘁𝗼 𝗮𝗻 𝗼𝗯𝗷𝗲𝗰𝘁.

There have been 𝗱𝗶𝘀𝗰𝘂𝘀𝘀𝗶𝗼𝗻𝘀 in the 𝗘𝗖𝗠𝗔𝗦𝗰𝗿𝗶𝗽𝘁 working group proposing the following 𝗰𝗵𝗮𝗻𝗴𝗲:
𝘁𝘆𝗽𝗲𝗼𝗳 𝗻𝘂𝗹𝗹 === "𝗻𝘂𝗹𝗹"; // true

But 𝗶𝘁 𝘄𝗮𝘀 𝗿𝗲𝗷𝗲𝗰𝘁𝗲𝗱 and 𝗖𝗿𝗼𝗰𝗸𝗳𝗼𝗿𝗱 pointed out: I think 𝗶𝘁 𝗶𝘀 𝘁𝗼𝗼 𝗹𝗮𝘁𝗲 𝘁𝗼 𝗳𝗶𝘅 𝘁𝘆𝗽𝗲𝗼𝗳. The change proposed for the typeof null will break the existing code.

For an in-depth explanation, you can read the article by Axel Rauschmayer.