I'm not sure if this is just a documentation bug or if we actually want to create a SomeType instance. In general nil receivers are fine, but I agree it doesn't make sense for UnmarshalJSON to be given a nil receiver.
My understanding is that this is working as intended. In the first case, Outer is a Marshaler, so Unmarshal will call its custom UnmarshalJSON on it directly. While in other cases, Outer is not a Marshaler. The default behavior for Unmarshal is documented as:
If the pointer is nil, Unmarshal allocates a new value for it to point to.
Yes, @shantuo is right. From the json package's point of view, it allocates an Outer, sees that Outer has an UnmarshalJSON method (due to the embedding), and invokes Outer's UnmarshalJSON method. The raison d'être of UnmarshalJSON is to stop the usual processing, and in this case, that means not looking inside Outer at all. The json package cannot be responsible for allocating the inner struct.
Other ways to write this code include embedding a struct instead of a pointer-to-struct.