Yeah but you could have a shell script that does

    rm -rf /foo/bar

and in theory it could reduce it to

    rm -rf /

The passes are very heuristic, so that doesn't seem like something you can rule out.

(and I actually want to run it on shell scripts! )