According to this from ESPN:
The World Cup has never required lots to be drawn. Before 1958, replays and playoff were used to settle ties. Since then, even as the tournament has expanded from 16 to 24 to 32 teams, all qualifying issues have been settled by the factors used to determine a group's ranking: (1) points; (2) goal differential; (3) goals scored; (4) if two teams are still tied, head-to-head results are applied; (5) with three teams tied ... points, goal differential and goals scored are calculated among the teams involved (essentially throwing out the result against the other team in the group).
(In 1990, Netherlands and Ireland finished tied for second in Group F behind England. Both teams tied all three matches, including a 1-1 draw against each other, and were thus level on all tiebreakers. At that time, the four best third-place teams also advanced to the round of 16, so either team would have qualified regardless. FIFA held a draw to determine each team's placement. Ireland won the draw to finish second and proceeded to advance past Romania on penalty kicks in the round of 16 before losing to Italy in the quarterfinals. As the third-place team, Netherlands faced eventual champion West Germany in the round of 16 and lost 2-1.)