Common NAT* as implemented in SoHo routers (i.e. DSL, FTTH, cable etc) maps multiple internal (local) IP addresses to a single external (public) IP address. Reaching an internal system from outside requires a way to translate a packet coming in on the external (internet) interface (i.e. using the external IP+port as destination) to a packet on the internal network (using an IP+port on the internal network as destination).
With port forwarding, there is a predefined and fixed translation to a specific host and port.
Any other translation in NAT needs an outgoing packet from the internal to the external (internet) network first: the necessary translation from internal IP+port to external in the NAT table is only created if an outgoing packet creates a new state, like in a stateful firewall. If an incoming packet matches such a state/translation then the external IP+port can be translated back into an internal IP+port. If there is no state/translation then it is unknown how the packet should be translated and thus it gets discarded.
In other words: there is no magic packet that can pass through NAT because it is unknown which internal system this packet should be sent to.
But note that this does not mean that no direct access to internal systems can be initiated from outside. With IPv6 it is possible that the ISP assigns a customer a range of IPv6 address with the same prefix and the router makes these addresses usable in the internal network. Unless the router specifically blocks direct access an internal system could be reachable from outside by its public IPv6 address. But this is not traversing NAT since no NAT is involved here.
Additionally some routers erroneously make UPnP accessible on the external interface. This could allow an attacker to create explicit port forwardings on the router in order to access internal systems. But, this is still not a magic packet traversing the NAT.
* Note that there are also other type of NAT, where some set of public IP addresses gets translated to a set of local IP addresses. This might for example be used to map a range of local IPv4 addresses into a set of publicly accessible IPv6 addresses with the same prefix. I don't know of any SoHo router which offers this functionality.