The documentation says it's OpenSSL, not PBKDF2:
When you use a CipherParams object in a string context, it's automatically converted to a string according to a format strategy. The default is an OpenSSL-compatible format
This can be verified in the source code. The implementation of the OpenSSL KDF is in evpkdf.js.
The key derivation function is usually referenced as EVP_BytesToKey which is the higher level function in the API that implements the KDF.
