probably some third memory region where the compiler stores its static stuff. Might also be in the data region of the global static variables.
I could also imagine compilers that store the vtable directly inlined into the object in some cases - e.g. before the object's variable space start.. then it would be either on the stack or heap - depending where you created your object.
Counter-question: Why do you need to know? Sound like you plan something evil.. :-D (By that, I mean that you shouldn't concern where it is stored as it is compiler-intern stuff anyway.)