> A variable in a function scope or runtime malloc'd spot? No chance of finding a stable spot.

It depends, on a system with no ASLR it's potentially still deterministic, but there are a lot of potential sources of non-determinism.