"At what position (ie., sp value) the return address is pushed when timer ISR is called (the code is compiled using SDCC)?"

This is defined by the 8051 CPU hardware - so you need to read the "80C51 family hardware description"

See the 'Links' section.

Do not try to fiddle with the Stack-Pointer in 'C'. Use Assembler!