How is "test1" instantiated in UVM express example 04?

That’s what run_test does. It creates an instance of test1 from the factory. See the Cookbook here and here for more information. We usually recommend that you call run_test() with no arguments and specify the test name on the command line via +UVM_TESTNAME.