In theory it is a JVM secret, in practice it is 0 (0x00000000) on 32-bin VM. If you use Oracle JVM you can use sun.misc.Unsafe, which can read memory content at any address, to verify. 
public class Test {
    int i1 = 100;
    String s = null;
    int i2 = 200;
    public static void main(String[] args) throws Exception {
        Test test = new Test();
        System.out.println(getInt(test, "i1"));
        System.out.println(getInt(test, "s"));
        System.out.println(getInt(test, "i2"));
    }
    static int getInt(Test test, String name) throws Exception {
        Unsafe u = getUnsafe();
        long offset = u.objectFieldOffset(Test.class.getDeclaredField(name));
        return u.getInt(test, offset);
    }
    static Unsafe getUnsafe() throws Exception {
        Field f = Unsafe.class.getDeclaredField("theUnsafe");
        f.setAccessible(true);
        return (Unsafe) f.get(null);
    }
}
output
100
0
200