How does Global.asax PostAuthenticateRequest event binding happen?

Magic..., a mechanism called Auto Event Wireup, the same reason you can write

Page_Load(object sender, EventArgs e) { } 

in your code-behind and the method will automatically be called when the page loads.

MSDN description for System.Web.Configuration.PagesSection.AutoEventWireup property:

Gets or sets a value indicating whether events for ASP.NET pages are automatically connected to event-handling functions.

When AutoEventWireup is true, handlers are automatically bound to events at run time based on their name and signature. For each event, ASP.NET searches for a method that is named according to the pattern Page_eventname(), such as Page_Load() or Page_Init(). ASP.NET first looks for an overload that has the typical event-handler signature (that is, it specifies Object and EventArgs parameters). If an event handler with this signature is not found, ASP.NET looks for an overload that has no parameters. More details in this answer.

If you wanted to do it explicitly you would write the following instead

public override void Init(){    this.PostAuthenticateRequest +=        new EventHandler(MyOnPostAuthenticateRequestHandler);    base.Init();}private void MyOnPostAuthenticateRequestHandler(object sender, EventArgs e){}