I've seen 'code reviews' that were in fact functionality checks. So it's more like a 'check if this code works'.

And I can tell you: a web form capable of SQL-injections is still 'working code'. So it gets a positive 'code review'.