It is called by the container.
There are several cases where the container can or will call this method.
The most common is when the servlet is being taken out of service.
SRV.2.3.4 End of Service
The servlet container is not required to keep a servlet loaded for any particular
period of time. A servlet instance may be kept active in a servlet container for a
period of milliseconds, for the lifetime of the servlet container (which could be a
number of days, months, or years), or any amount of time in between.
When the servlet container determines that a servlet should be removed from
service, it calls the destroy method of the Servlet interface to allow the servlet to
release any resources it is using and save any persistent state. For example, the
container may do this when it wants to conserve memory resources, or when it is
being shut down.
Before the servlet container calls the destroy method, it must allow any
threads that are currently running in the service method of the servlet to complete
execution, or exceed a server-defined time limit.
The best way to find out when the container may also call the destroy method is to download the servlet spec (link in my signature) and perform a search on the
word "destroy".