Ok so we have two VLANS  each with their own subnet with a router connecting the them.  The subnet in VLAN22 has an address range of 172.20.22.0/24 and VLAN23 has an address range of 172.20.23.0/24.  So an example host in VLAN22 (let's call this one Host A) is setup as follows: IP: 172.20.22.15, Subnet Mask: 255.255.255.0, Gateway 172.20.22.1 and an example host in VLAN23 (let's call this one Host B) is setup as follows: IP: 172.20.23.15, Subnet Mask: 255.255.255.0, Gateway 172.20.23.1.  Ok so we had a problem the other day here.  Host B is setup as a webserver and Host A is running a web browser connecting to Host B.  Host A is able to load pages served by Host B.  No problem.  

The question arose when we added a second host into VLAN22.  Let's call this one Host AA.  It was incorrectly setup by the technician setting it up -- like this : IP: 172.20.22.16, Subnet Mask: 255.255.0.0, Gateway nothing.  So the subnet mask was wrong (16 bit instead of 24) and there was no gateway address entered at all.  However, Host AA was still able to connect to the webserver on Host B and load pages etc.  
My question is, why was Host AA still able to connect to Host B on another subnet & VLAN even though it didn't have a gateway address?  I'm guessing that the answer has something to do with the incorrect 16 Bit mask on Host AA and something related to Classless Inter-Domain routing but I'm not able to offer a great explanation.  

Thoughts?