It's not safari that does it but the "OS" itself, and by that I mean the wireless networking tool. I would imagine that there's some code that runs upon successful connection to an AP and checks to see if you're in a captive portal or not.

The resulting UI looks like a plain window with no UI elements except a close button and a browser frame so you can auth with the captive portal system, and goes away once connectivity is "restored".