
I was looking for something the code was doing, rather than something it wasn't (if that makes any sense?) I should have spotted that.
Actually, looking a little deeper, it is clear that the calling code does not place the address of the string variable on the stack, but the address of the underlying character buffer. This means that the function has no chance of pointing the original string variable to any new buffer which is allocated.
