Short answer, loggedin with root reside virtual consoles(i.e. Ctrl+Alt+N), then start pulseaudio daemon and play video:
/usr/bin/pulseaudio --start
mplayer -vo fbdev2 test.mp4
[Important] tried with /usr/bin/pulseaudio --system is not required here. And you MUST reside root(not sudo or even su) AND virtual consoles to perform all the step including start daemon and play video. No effect if you try su and start daemon inside X Session's virtual terminal.
Long answer, how i figure out:
First step, open new terminal with new virtual console. The reason behind is because X session most likely will not work with framebuffer.
Now i need to know is it limited to mplayer or not. So i tried with play command to play basic music, e.g. built-in kde sounds, play /usr/share/sounds/KDE-Im-Cant-Connect.ogg with sudo on new virtual console:
$ sudo play /usr/share/sounds/KDE-Im-Cant-Connect.ogg
ALSA lib pulse.c:243:(pulse_connect) PulseAudio: Unable to connect: Connection refused
play FAIL formats: can't open output file `default': snd_pcm_open error: Connection refused
$
It's not limited to mplayer or complex song.
So now we have to dive into difference between got sound and no sound. let's try strace on normal user on X session(got sound), (file name su1.log is misleading here, nothing to do with su):
strace -o /tmp/su1.log -v -s 1000000 play
/usr/share/sounds/KDE-Im-Cant-Connect.ogg
and virtual console(no sound):
strace -o /tmp/su2.log -v -s 1000000 play
/usr/share/sounds/KDE-Im-Cant-Connect.ogg
vi /tmp/su2.log, navigate the end:
connect(8, {sa_family=AF_LOCAL, sun_path="/run/user/0/pulse/native"}, 110) = -1 ENOENT (No such file or directory)
close(8) = 0
socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC, 0) = 8
fcntl(8, F_GETFD) = 0x1 (flags FD_CLOEXEC)
setsockopt(8, SOL_SOCKET, SO_PRIORITY, [6], 4) = 0
fcntl(8, F_GETFL) = 0x2 (flags O_RDWR)
fcntl(8, F_SETFL, O_RDWR|O_NONBLOCK) = 0
connect(8, {sa_family=AF_LOCAL, sun_path="/var/run/pulse/native"}, 110) = -1 ENOENT (No such file or directory)
close(8) = 0
write(5, "x", 1) = 1
write(2, "ALSA lib pulse.c:243:(pulse_connect) ", 37) = 37
write(2, "PulseAudio: Unable to connect: Connection refused\n", 50) = 50
write(2, "\n", 1) = 1
futex(0x135a8e0, FUTEX_UNLOCK_PI_PRIVATE, 0) = 0
sendto(7, "W", 1, MSG_NOSIGNAL, NULL, 0) = -1 ENOTSOCK (Socket operation on non-socket)
write(7, "W", 1) = 1
futex(0x135a8e0, FUTEX_UNLOCK_PI_PRIVATE, 0) = 0
futex(0x7f34065089d0, FUTEX_WAIT, 7956, NULL) = -1 EAGAIN (Resource temporarily unavailable)
munmap(0x7f3406509000, 67112960) = 0
unlink("/dev/shm/pulse-shm-3719764676") = 0
close(6) = 0
close(7) = 0
close(5) = 0
close(4) = 0
write(2, "play FAIL formats: ", 19) = 19
write(2, "can't open output file `default': snd_pcm_open error: Connection refused", 72) = 72
write(2, "\n", 1) = 1
And also kdiff3 to compare both logs's "open(":
$ grep 'open(' /tmp/su1.log > /tmp/su1_open.log
$ grep 'open(' /tmp/su2.log > /tmp/su2_open.log
$ kdiff3 /tmp/su1_open.log /tmp/su2_open.log
$

It's slightly different for /run/user/0/pulse, now i realized uid 1000(normal user) and 0(root) stuff, in which "/run/user/1000/pulse" and "run/user/0/pulse" only request when play with uid 1000 and 0 respectively:
$ grep 'run/user/0/pulse' /tmp/su1.log
$ grep 'run/user/1000/pulse' /tmp/su2.log
$ grep 'run/user/1000/pulse' /tmp/su1.log
recvmsg(5, {msg_name(0)=NULL, msg_iov(1)=[{"\1\10\2\0\21\0\0\0\37\0\0\0\0\0\0\0B\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{34959d136592433aad171659a5cd523f}unix:/run/user/1000/pulse/native\0\0", 4096}], msg_controllen=0, msg_flags=0}, 0) = 100
connect(5, {sa_family=AF_LOCAL, sun_path="/run/user/1000/pulse/native"}, 110) = 0
recvmsg(6, {msg_name(0)=NULL, msg_iov(1)=[{"\1\10\2\0\21\0\0\0\37\0\0\0\0\0\0\0B\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{34959d136592433aad171659a5cd523f}unix:/run/user/1000/pulse/native\0\0", 4096}], msg_controllen=0, msg_flags=0}, 0) = 100
connect(6, {sa_family=AF_LOCAL, sun_path="/run/user/1000/pulse/native"}, 110) = 0
$ grep 'run/user/0/pulse' /tmp/su2.log
mkdir("/run/user/0/pulse", 0700) = -1 EEXIST (File exists)
open("/run/user/0/pulse", O_RDONLY|O_NOCTTY|O_NOFOLLOW|O_CLOEXEC) = 5
lstat("/run/user/0/pulse", {st_dev=makedev(0, 41), st_ino=86867, st_mode=S_IFDIR|0700, st_nlink=2, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=40, st_atime=2015/07/22-01:44:45, st_mtime=2015/07/22-01:44:45, st_ctime=2015/07/22-01:47:59}) = 0
lstat("/run/user/0/pulse", {st_dev=makedev(0, 41), st_ino=86867, st_mode=S_IFDIR|0700, st_nlink=2, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=40, st_atime=2015/07/22-01:44:45, st_mtime=2015/07/22-01:44:45, st_ctime=2015/07/22-01:47:59}) = 0
connect(5, {sa_family=AF_LOCAL, sun_path="/run/user/0/pulse/native"}, 110) = -1 ENOENT (No such file or directory)
mkdir("/run/user/0/pulse", 0700) = -1 EEXIST (File exists)
open("/run/user/0/pulse", O_RDONLY|O_NOCTTY|O_NOFOLLOW|O_CLOEXEC) = 8
lstat("/run/user/0/pulse", {st_dev=makedev(0, 41), st_ino=86867, st_mode=S_IFDIR|0700, st_nlink=2, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=40, st_atime=2015/07/22-01:44:45, st_mtime=2015/07/22-01:44:45, st_ctime=2015/07/22-01:47:59}) = 0
lstat("/run/user/0/pulse", {st_dev=makedev(0, 41), st_ino=86867, st_mode=S_IFDIR|0700, st_nlink=2, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=40, st_atime=2015/07/22-01:44:45, st_mtime=2015/07/22-01:44:45, st_ctime=2015/07/22-01:47:59}) = 0
connect(8, {sa_family=AF_LOCAL, sun_path="/run/user/0/pulse/native"}, 110) = -1 ENOENT (No such file or directory)
$
"No such file or directory" only when /run/user/0/pulse, let's check(with root):
# l /run/user/0/pulse/
total 0
84490 drwx------. 4 root root 80 Jul 22 01:44 ..
86867 drwx------. 2 root root 40 Jul 22 01:44 .
#
# l /run/user/1000/pulse/
total 4.0K
29328 -rw-------. 1 xiaobai xiaobai 5 Jul 22 00:58 pid
30544 srwxrwxrwx. 1 xiaobai xiaobai 0 Jul 22 00:58 native
31058 drwx------. 2 xiaobai xiaobai 80 Jul 22 00:58 .
27430 drwx------. 14 xiaobai xiaobai 280 Jul 22 01:06 ..
# l /run/user/1000/pulse/native
30544 srwxrwxrwx. 1 xiaobai xiaobai 0 Jul 22 00:58 /run/user/1000/pulse/native
# file /run/user/1000/pulse/native
/run/user/1000/pulse/native: socket
# file /run/user/1000/pulse/pid
/run/user/1000/pulse/pid: ASCII text
# cat /run/user/1000/pulse/pid
2205
#
At this point i know pid 2205 is running and supposed to be exist with uid 0 to make it works.
I google and found pulseaudio --check:
# pulseaudio --check
Tried with arg verbose, gotcha! daemon is running as pid 2205, proved what I've observed above:
# pulseaudio --check -v
I: [pulseaudio] main.c: Daemon running as PID 2205
#
So now i confident that pulse audio can make it works. Check pid 2205 to find out how it was triggered:
# ps aux|grep 2205
xiaobai 2205 0.0 0.2 565980 11080 ? S<l 00:58 0:01 /usr/bin/pulseaudio --start
root 8747 0.0 0.0 113008 2300 pts/2 S+ 01:58 0:00 grep --color=auto 2205
#
So let's tried /usr/bin/pulseaudio --start:
# /usr/bin/pulseaudio --start
W: [pulseaudio] main.c: This program is not intended to be run as root (unless --system is specified).
N: [pulseaudio] main.c: User-configured server at {34959d136592433aad171659a5cd523f}unix:/run/user/1000/pulse/native, which appears to be local. Probing deeper.
What now, new pulse directory is appear under uid 0 with new pid:
# l /run/user/0/
total 0
17794 drwxr-xr-x. 4 root root 80 Jul 22 01:44 ..
85629 drwxr-xr-x. 2 root root 80 Jul 22 01:44 systemd
84490 drwx------. 4 root root 80 Jul 22 01:44 .
86867 drwx------. 2 root root 80 Jul 22 02:02 pulse
# cat /run/user/0/pulse/pid
9731
#
And finally the sound is works. Try it yourself now with mplayer -vo fbdev2 test.mp4
[Note] su might work in some weird circumstance. E.g. X session 11 -> Ctrl+Alt+2 -> login with uid 1000 -> su - root -> /usr/bin/pulseaudio --start and mplayer -vo fbdev2 works fine. Then Ctrl+Alt+3 -> login with root -> /usr/bin/pulseaudio --start and mplayer works together -> go back Ctrl+Alt+2 -> mplayer on virtual console 2 no longer works.