Probably because stdio.h #defines NULL to a specific value if it isn't defined.
The standard VS C++ stdio.h uses this:
#ifndef NULL
#ifdef __cplusplus
#define NULL 0
#else /* __cplusplus */
#define NULL ((void *)0)
#endif /* __cplusplus */
#endif /* NULL */
But it would be possible to define a NULL that still ended up as a void pointer after the addition of the (int) cast. And since a pointer + 1 increments by the size of a "machine word", it's quite likely that in a 32 bit environment, the resulting address would be four.
I'd start by looking at the exact content of your include files and check what they define NULL as (since it isn't defined as a C or C++ keyword)