GC: Understanding potential sources of false pointers

[Nick Sabalausky (Abscissa) via Digitalmars-d-learn]

According to <http://dlang.org/phobos/core_memory.html>:

"Registers, the stack, and any other memory locations added through the 
GC.addRange function are always scanned conservatively."

1. Can that be safely assumed to be a canonical list of all possible 
sources of false pointers?

2. What about memory allocated through language constructs such as 
"new", append ("~"/"~="), closures, or any others I may be forgetting? 
Is this memory always/never/sometimes set to NO_SCAN? (I assume not 
"always", as that would be silly.) If "sometimes", what are the conditions?

A couple specific examples:

3. Are there any situations where a (for example) int[] or long[] that 
is stored on the GC heap could lead to false pointers?

4. Same question as #3, but if it's an array of structs, and the struct 
type contains no members that are statically-typed as pointers.