It happened to a friend of mine (almost exactly the way 'ghshephard spelled out). In fairness, partly because of hearing that story, I didn't buy my vested options when I left my last startup; those options paid out when the company was later acquired.
Was this is US-based company? The way I understand ISOs in the US, they must be exercised within 3 months of leaving the company ("The option may be granted only to an employee [..], who must exercise the option while he/she is an employee or no later than three (3) months after termination of employment" -- http://en.wikipedia.org/wiki/Incentive_stock_option).
Yes; you pay money to exercise the options and receive restricted stock. That's the thing I opted not to do, because friends of mine who did so at another large VC-funded success story got ripped off.
