AFL might eventually get lucky, but I'm guessing you'd want a hybrid approach that combines symbolic execution with a fuzzer like AFL, e.g. QSYM [1].

[1] https://www.usenix.org/system/files/conference/usenixsecurit...