When you use “Hello” for the first time, it’s interned into the application global store of strings.
Based on the fact you’re executing in unsafe mode (more about unsafe here) you obtain a direct reference to data stored in the locations originally allocated for the value of string s, so by
for (int i = 0; i < s.Length; i++)
c[i] = 'a';
you’re editing what’s in memory. When it accesses the store of interned strings next time, it will use the same address in memory, holding the data you’ve just changed. That would not be possible without unsafe. string.Intern(s); doesn’t play a role here; it behaves the same if you comment it out.
Then by
Console.WriteLine("Hello"); // Displays: "aaaaa"
.NET looks at whether there is an entry for an address obtained for "Hello" and there is: the one which you’ve just updated to be "aaaaa". The number of 'a' characters is determined by the length of "Hello".