Without accessing the code how can a reviewer confirm if the simulation results are correct? I have been reviewing the articles for various top-rank journals and conferences for the last few years.  After all these experiences, I can tell you there is no way to confirm the correctness of simulation results. Therefore, I usually make comments on design, procedure, mathematical and analytical analysis.

In the results section, I can ask some questions about why this or that is so, but how can I judge if the simulation was really performed or these are just fabricated graphs?

This question came in my mind because I observed on few occasions, during review process, a reviewer ask for including new results, which in my opinion required a lot of coding and effort to implement, but author responded within 7-10 days with new results and improved article.
Do you have reason to doubt their veracity or good faith? Are their claims somehow not believable or highly questionable based on your knowledge of the field? If it isn't standard in your field to release code I don't think a reviewer should necessarily demand it, regardless of your feelings about making code public.

The authors should describe their methodology sufficiently for someone else to replicate it; in that way, they are putting their reputations at risk that were someone to duplicate their approach they would find the same results. Fabricating results is a very serious accusation. There are some statistical approaches to test whether data are likely to be fabricated, but the efficacy of this approach depends on the sophistication of the fabrication, and that question is better suited to CrossValidated.

If their work is meaningful in the field, at some point someone will implement their approach again. There is necessarily a bit of trust in science that people do what they say they've done. A reviewer should check that a paper's conclusions follow logically from their results, and that their methodology is described and sound, but they need not verify or replicate the results. As David Thornley points out in a comment on another answer, even simply running code tells you very little about those key factors, it only tells you if there is a blatant lie or mistake.