Devel::Peek confirms the difference:

use Devel::Peek;
#...etc...
bless $x{foo}, 'Null';

print Dump( $y );
print Dump( $x{foo} );
[download]

$y has FLAGS = (PADBUSY,PADMY,ROK) and $x{foo} has FLAGS = (ROK,OVERLOAD).

Fuller output:

SV = RV(0x1822a6c) at 0x181c38c        # $y
  REFCNT = 1
  FLAGS = (PADBUSY,PADMY,ROK)
  RV = 0x18014a0
  SV = PVHV(0x1821f90) at 0x18014a0
    REFCNT = 2
    FLAGS = (OBJECT,SHAREKEYS)
    IV = 1
    NV = 0
    STASH = 0x180b584   "Null"
    ARRAY = 0x301120  (0:7, 1:1)
    hash quality = 100.0%
    KEYS = 1
    FILL = 1
    MAX = 7
    RITER = -1
    EITER = 0x0
    Elt "a" HASH = 0xca2e9442
    SV = PV(0x1801678) at 0x181c4dc
      REFCNT = 1
      FLAGS = (POK,pPOK)
      PV = 0x301110 "b"\0
      CUR = 1
      LEN = 2
SV = RV(0x1822a74) at 0x181c4f4        # $x{foo}
  REFCNT = 1
  FLAGS = (ROK,OVERLOAD)
  RV = 0x18014a0
  SV = PVHV(0x1821f90) at 0x18014a0
    REFCNT = 2
    FLAGS = (OBJECT,SHAREKEYS)
    IV = 1
    NV = 0
    STASH = 0x180b584   "Null"
    ARRAY = 0x301120  (0:7, 1:1)
    hash quality = 100.0%
    KEYS = 1
    FILL = 1
    MAX = 7
    RITER = -1
    EITER = 0x0
    Elt "a" HASH = 0xca2e9442
    SV = PV(0x1801678) at 0x181c4dc
      REFCNT = 1
      FLAGS = (POK,pPOK)
      PV = 0x301110 "b"\0
      CUR = 1
      LEN = 2
[download]

I notice that the OVERLOAD flag is on the scalar itself rather than the reference it's holding. The reference knows that its an object but not that it's overloaded. I guess to get $y to be overloaded, you'd have to rebless it directly. That said, given a reference, I don't know how you'd find other scalars that have the reference.

Update: See also Is it possible to obtain all hardreferences to some memory address by knowing only one of them?