All string-buffer operations can potentially change the stack in unspecified ways; the push/pop documentation in the manual should reflect that.