Yes it works but it is not safe. arr[i] is just an address in RAM when you do scanf("%s",arr[i]);
The characters read will be stored sequentially into the adress starting from pointed out by arr[i].
Lets say you had a memory of 100 chars when you did malloc you may get addresses 10, 20, 30, 40 and 50. Even when you read 5 characters into each of these starting addresses it works. But in case if malloac returns address pointers to 10, 13, 16, 19 and 22. When you do scanf("%s",arr[0]);
with 5 chars say 'abcde' the string will be stored in locations from 10 to 15 (one for \0). When you do scanf("%s",arr[1]);
with input 'fghij' it will start writing from location 13. Now if you do printf on arr[0] you will get abcfghij.
This behavior depends on the compiler.