I feel In general a pointer to a stack object is 2nd best as it may become stray pointer. However, in my CSM data validation, statistical, visualization system, i used many arrays and strings without malloc().
a pointer to a global object is possible, but I didn’t use a whole lot of globals.
I guess my CSM team constructed many local arrays in outer functions (main()), and pass them into nested functions, so they stay in scope (throughout). Pointer to local is fine.
Also, static local variables were probably the 2nd popular choice we took.
In conclusion, we probably did use pointer-based collections but without heap/malloc(). Pointers to static locals, globals and main() method locals.
Also note function pointers point to neither heap nor stack.