I'm not totally sure of this but I think I can tell you the reason:
When the source-code of the second function is parsed, the browser will know that there's going to be declared a variable 'a' in this function.
'var' tells it that 'a' should be a new variable within the function scope (not global).
If there was no 'var' (like in first function), it will use the variable 'a' that's already declared in global scope.
So when it starts to execute the function, it allocates memory for it (and all other variables that are about to be declared in the function). Because 'a' is only defined but not yet initialized when the 'alert()' function accesses 'a', it returns 'undefined'.
Some tricky scope topic here :)