BufferOverFlow – How come ESP points to the end of the payload


I just don’t understand how ESP points to the shellcode

let’s say we’ve sent this string

string = 100 * 'A' + 'BBBB' + 'CCCC' 

I have filled the stack with ‘AAAA..’ and overwritten the EIP value and set it to ‘BBBB’ and I got the segmentation fault as expected, what I don’t understand is when debugging the ESP points directly to ‘CCCC’, isn’t the ESP pointing to the top of the stack, and we have already filled the stack with ‘AAAA’, shouldn’t be ESP pointing to these AAAA?