All files are just a string of bytes. An MP4 file means, depending on who you ask, a string of bytes that conforms to the MP4 standard, or that an MP4 player can do something with, or that has '00 00 00 18 66 74 79 70 6D 70 34 32' as the first twelve bytes (many file format standards always start with some fixed string of bytes so a program can look at just them to tell what kind of file it is. This is called a Magic Number). In principle you could craft a valid MP4 file with a hex editor, just typing in the bytes one by one, but since the MP4 standard is pretty complex it would be a lot of effort.
In the context of crafted exploit files, an MP4 file is one that the target MP4 player will read and say 'this is an MP4 file', before trying to process it. That might mean it has the magic number, or possibly just the extension '.mp4'. It can be crafted in any way you might create an arbitrary file, but probably by either modifying a program that creates mp4 files or taking a valid mp4 file and modifying it manually in a hex editor. Most crafted exploit files aren't actually truly valid but rather just pretending to be MP4 files (or whatever).
so,
1) He could craft it using any method of writing bytes to a file, but in practice probably did it by modifying something that produced or was a valid MP4 file already.
2) You can reproduce the bug by trying to play the poc file on a vulnerable android version (Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9. Android ID: A-130024844 apparently), or otherwise in an environment where it will be processed using a vulnerable version of Android Video Player.
3) You could put the vulnerable software in a debugger and see exactly what happens when you feed it hvec-crash-poc.mp4. Note that OllyDbg won't help you here, you need a debugger that works in an Android environment while OllyDbg is Windows-specific. From the screenshots on the GitHub page it looks like he's using GDB. I don't work with Android much so don't quote me on this, but I think the vulnerable software in question (Android Video Player) is a system service that you'd have to attach the debugger to, this will require a rooted Android (or Android emulator).