The original Bourne Shell did not use malloc, but rather had a SIGSEGV handler
that used to extend the "string stack" called "stak" via sbrk() whenever the
code tried to access data beyond the end ot the heap.

The V6 (Mashey) shell did that.   I thought they’d gotten rid of that by the time the Bourne Shell rolled around.

When we ported  UNIX to the Denelcor HEP supercomputer, we had only a single base-offset segment (albeit 64 bits).   The data and stack were allocated from that.   In fact, the “stack” was a linked list.