Event dispatch should avoid malloc by using EventPromise Darin had this idea a long while back. SVG would benefit from this, see bug 16447. Basically there would be an EventPromise object which was used during EventDispatch (passed "const EventPromise&" up the dispatch chain), which knew how to create an Event subclass with the right information if a listener was found, but otherwise would avoid malloc.
Once version of the idea here is that the EventPromise has enough functions in it to do everything in the dispatching process except for dispatching to JavaScript. So as long as there are no JavaScript event handlers, you can just use the stack-based one. Another version, probably better, is that EventPromise simply has enough in it for simpler events; ones that are dispatched in response to engine events and that have very little data in them. For more complex events like keyboard events the EventPromise would simply wrap an already-created Event object of the appropriate subclass.