> All of this gets easier if you can augment your static analysis with control flow traces from program executions with coverage of the relevant branches, so you don't miss basic block entry points.

That's only true if the traces you can generate do a reasonable job at covering the states the application can find itself in, which is a big assumption.