I have the following configuration (I'd post a pic but not enough rep for more than 2):
PC1 (10.0.2.10/24) and PC2 (10.0.2.137/29) are connected to a hub, which is connected to a router on interface FastEthernet0/1 (10.0.2.138/24).
I ran two tests with this configuration.
First test: I sent a ping from PC1 to PC2, having set no default gateways for either host. PC1 thinks that PC2 is in the same subnet, so it sends out an ARP broadcast. It is not though, so it does not receive any replies. So far so good. Result
Second test: I set the router as the default gateway in PC1 and PC2's routing tables. I then sent a ping from PC1 to PC2 once again. This time, PC2 seems to reply to PC1's ARP broadcast directly, and PC1 proceeds to send PC2 the ping request. PC2 then uses its routing table to reply to PC1 via the default gateway and then gets an ICMP redirect to update its routing cache to reply directly to PC1 instead. Result
My confusion: how does PC2 reply to PC1's ARP broadcast when it's on a different subnet? How does having a default gateway allow this? At first I thought Proxy ARP is being used, but that doesn't seem to be the case, as the source and destination addresses of the ARP packets are those of PC1 and PC2, not the router's.