An instrumented fuzzer like AFL purports to do this:

http://lcamtuf.coredump.cx/afl/

This blog post is a fascinating description of its potential:

http://lcamtuf.blogspot.com/2014/11/pulling-jpegs-out-of-thi...

I haven't had as much success with it, but it's so interesting that I'll keep trying. I'm also interested in KLEE, which I found in a similar HN story, but it has very specific build requirements:

https://klee.github.io

[Edit: bhouston posted the exact same links minutes before I did. Anyway, cool stuff.]