For myself, the answer is quite simple: I don't. VirtualBox used to make
my life easier, but the combination of not being available in Debian
testing with the *reasons* why it isn't available there
(license-related, last time I checked, if I remember correctly) mean the
ways in which it used to make my life easier aren't worth the trouble of
getting it from somewhere else, at least not to me.
When running stable or testing, installing a package from sid is at
least mildly inadvisable - because it may pull in dependencies from sid,
thereby leading to your running not only a FrankenDebian but one which
is partly sid and therefore includes some of the risks that come with
running sid.
Installing a package from a third-party repository has its own risks,
and I no longer trust Oracle to do the right thing when it comes to
open-source software, so I can't recommend installing VirtualBox from
their repository.