It doesn’t matter to unsafe_load who allocated the memory behind the pointer. It simply loads the value behind the pointer, i.e. it dereferences the pointer.
You don’t construct anything; unsafe_load gives you the object at the address of that pointer. The object already exists right there. Does the object not exist at that address?
I am pretty sure that this is an artifact of accessing the non-const global tpsa. The allocation should be from the resulting dynamic dispatch.