Suppose the following piece of code
struct S { S(int & value): value_(value) {} int & value_; }; S function() { int value = 0; retur
I don't think any static tool can catch that, but if you use Valgrind along with some unit tests or whatever code is crashing (seg fault), you can easily find where the memory is bring referenced and where it was allocated originally.